Update the remote wiki-query prompt so it still forbids arbitrary shell, writes, ingest/update/rebuild, and sync/config/timer operations while explicitly allowing the read-only business facts schema/template/sql commands used by the wiki-query business route. Document the allowlist and cover it in MCP query prompt tests.
Validation: python3 -m unittest tests/test_mcp_query.py -v; python3 -m unittest tests/test_business_facts.py -v; python3 -m unittest discover -v; python3 -m compileall obsidian_wiki tests scripts; git diff --check