feat(mcp): Add MCP transaction update tool (#2719)

* Add MCP transaction update tool

* Fix MCP transaction authorization

* Ignore Pipelock false positive on SnapTrade token lookup

Pipelock scan-diff flags `token = oauth_refresh_token...` as
"Credential in URL" even though these are ActiveRecord attribute
names, not embedded secrets. Add the established inline ignore.

Co-authored-by: Martin Molcrette <Mart1M@users.noreply.github.com>

---------

Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Martin Molcrette <Mart1M@users.noreply.github.com>

test/models/assistant/function/get_transactions_test.rb

@@ -0,0 +1,44 @@
+require "test_helper"
+
+class Assistant::Function::GetTransactionsTest < ActiveSupport::TestCase
+  setup do
+    @user = users(:family_admin)
+    @transaction = transactions(:one)
+    @function = Assistant::Function::GetTransactions.new(@user)
+  end
+
+  test "returns transaction ids and notes" do
+    @transaction.entry.update!(notes: "Visible note")
+
+    result = @function.call(
+      "page" => 1,
+      "order" => "asc",
+      "search" => @transaction.entry.name
+    )
+
+    transaction = result[:transactions].find { |item| item[:id] == @transaction.id }
+
+    assert_not_nil transaction
+    assert_equal @transaction.entry.notes, transaction[:notes]
+  end
+
+  test "excludes transactions from inaccessible accounts" do
+    hidden_entry = Entry.create!(
+      account: accounts(:investment),
+      name: "Private investment transaction",
+      date: Date.current,
+      amount: 100,
+      currency: "USD",
+      entryable: Transaction.new
+    )
+    hidden_entry.update!(notes: "Private note")
+
+    result = Assistant::Function::GetTransactions.new(users(:family_member)).call(
+      "page" => 1,
+      "order" => "asc",
+      "search" => hidden_entry.name
+    )
+
+    assert_empty result[:transactions]
+  end
+end