feat(tools): wrap the two new v1.0.43 endpoints (compose validate + settings/semver)

[strausmann]

Context

v1.0.43 added two endpoints the MCP does not wrap yet (pin bumped in #229, spec now info.version: 1.0.43):

• POST /api/stacks/{name}/validate — Compose Validate, a preflight linter/validator that returns findings with severity + line numbers.
• GET / POST /api/settings/semver — global newer-version-tag detection config (the semver knobs relocated here from environments/{id}/update-check).

They surface as coverage candidates once the second (unpinned) spec source is retired via #222 / PR #226.

Proposal — add tools

• validate_stack_compose → POST /api/stacks/{name}/validate. Returns the linter findings (severity/line). Read-oriented (no mutation), so no confirmation gate.
• get_semver_settings → GET /api/settings/semver (1:1 read proxy).
• update_semver_settings → POST /api/settings/semver (1:1 write proxy).

Follow the existing 1:1-proxy tool pattern (TOOL_ENDPOINT_MAP, generated coverage/body-contract artifacts). TDD per repo conventions; keep the body-contract gate green.

Depends on / refs

• After chore(api): bump pinned Dockhand OpenAPI to v1.0.43 #229 (v1.0.43 pin bump) merges.
• Related: Source the OpenAPI spec from the pinned upstream commit (raw), not a live instance #222 / PR Consolidate the two spec sources into one pinned openapi source + hard body-contract PR gate #226 (spec-source consolidation) — the coverage report will then flag these two as MISSING_TOOL against the single source.