Expose patch-product as an MCP tool, scoped to a new restocker role

Adds the restocker KongConsumerGroup and patch-product to the tools policy,
allow: [admin, product_manager, restocker]. classic-models-api backs this the
same way — restocker may PATCH a product and nothing else.

Regenerated with generate-mcp-tools.py.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

kong/mcp/consumergroups.yaml

@@ -57,3 +57,15 @@ spec:
     konnectNamespacedRef:
       name: ${CONTROL_PLANE_REF_NAME}
   name: support
+  ---
+  apiVersion: configuration.konghq.com/v1beta1
+  kind: KongConsumerGroup
+  metadata:
+    name: ${NAME}-restocker
+    namespace: ${NAMESPACE}
+  spec:
+    controlPlaneRef:
+      type: konnectNamespacedRef
+      konnectNamespacedRef:
+        name: ${CONTROL_PLANE_REF_NAME}
+    name: restocker