Add redMCP user and membership tools

redMCP/README.md

@@ -65,6 +65,17 @@ $issueResults = $client->searchIssues('power supply', [
 ]);
 ```
 
+Project and user discovery is read-only:
+
+```php
+$projects = $client->projects(['limit' => 25]);
+$project = $client->project('fud-helpdesk', ['include' => 'trackers,enabled_modules']);
+$members = $client->projectMemberships('fud-helpdesk');
+
+$users = $client->users(['status' => 1, 'limit' => 25]);
+$user = $client->user(1, ['include' => 'memberships,groups']);
+```
+
 `updateIssue()` is intentionally safe by default: on Helpdesk-backed issues, a
 normal Redmine note does **not** send an email to the customer. To send through
 the Helpdesk plugin, opt in explicitly:
@@ -143,7 +154,8 @@ MCP_SERVER_TOKEN=test-token redMCP/bin/redmcp-http-server.php \
 
 Debug logs may include customer text, issue notes, search terms, email content,
 and IDs. Authorization headers, bearer tokens, and Redmine API keys are not
-logged.
+logged. MCP tool output also redacts credential fields returned by Redmine, such
+as `api_key`.
 
 Example stdio client configuration:
 
@@ -157,11 +169,11 @@ Example stdio client configuration:
 }
 ```
 
-Both transports expose tools for native Redmine project listing/detail,
-filtering/search, issue CRUD, Helpdesk-aware issue reads, and explicit Helpdesk
-email responses. Tools that can send customer-visible mail require an explicit
-tool call such as `redmine_send_helpdesk_response` or `redmine_update_issue`
-with `send_helpdesk_email=true`.
+Both transports expose tools for native Redmine project listing/detail, project
+memberships, users, filtering/search, issue CRUD, Helpdesk-aware issue reads,
+and explicit Helpdesk email responses. Tools that can send customer-visible mail
+require an explicit tool call such as `redmine_send_helpdesk_response` or
+`redmine_update_issue` with `send_helpdesk_email=true`.
 
 ## Test instance