Design tool: an approved database read/write is now bound to the exact action and project slug

Consent for read_db, write_db and watch is now recorded as {action, slug} in tool state and re-checked at call time. If the tool's action or url has changed since approval, the call is rejected with a new db_target_changed error instead of silently running against a different target than the one the user approved.

This behavior is reachable on this build without any flag involved.