fix: keep canAccess tools visible to sessions without auth after a runtime change - #389

Problem

Session creation only consults canAccess when the session has an auth object. With no authenticate configured (or none passed to connect()), every tool is visible; the existing test "canAccess works without authentication" and the README example canAccess: (auth) => auth?.role === "admin" rely on that.

FastMCPSession.toolsListChanged() did not apply the same rule. It called canAccess(undefined) on every tool, so:

• after any runtime addTool() / removeTool(), a tool with canAccess: (auth) => auth?.role === "admin" disappeared from tools/list for unauthenticated sessions, and tools/call on it answered "Unknown tool";
• a canAccess written without optional chaining (auth => auth.role === "admin") threw a TypeError out of server.addTool(), after #tools had already been updated, and skipped the refresh for every later session in the loop.

Repro:

const server = new FastMCP<{ role: string }>({ name: "T", version: "1.0.0" });
server.addTool({ name: "admin", canAccess: (a) => a?.role === "admin", execute: async () => "x" });
// connect an in-memory client with no auth
(await client.listTools()).tools.map((t) => t.name); // ["admin"]
server.addTool({ name: "public", execute: async () => "y" });
await new Promise((r) => setTimeout(r, 0));
(await client.listTools()).tools.map((t) => t.name); // ["public"]  <- admin vanished

Fix

toolsListChanged() now uses the same rule as #createSession: filter with canAccess only when the session has auth.

Tests

Two cases added to src/FastMCP.can-access-empty.test.ts (in-memory transport, no auth): the admin-only tool stays listed and callable after a runtime addTool(), and an addTool() with a canAccess that dereferences auth does not throw. Both fail on main and pass with this change. prettier, eslint and tsc --noEmit are clean.