feat(schema): meta.query in Collection-Meta + designGuide-Einrückung

Hooks lesen oft zusätzliche Query-Parameter (ctx.request().query(name)).
Mit meta.query werden sie deklariert, für Agenten dokumentiert
(REST _meta/OpenAPI, MCP collection_describe) und bei MCP-Calls
validiert. Vergleiche docs 04-collections (meta.query).

schemas/config/collection-meta.schema.json

@@ -50,7 +50,7 @@
         ]
       }
     },
-"designGuide": {
+    "designGuide": {
       "$ref": "defs.schema.json#/definitions/i18nText"
     },
     "imageUrl": {
@@ -465,6 +465,41 @@
     "openapi": {
       "$ref": "openapi.schema.json"
     },
+    "query": {
+      "description": "Additional query parameters hooks may read (ctx.request().query(name)). Documented for agents (REST _meta/OpenAPI, MCP collection_describe + extra argument) and validated on MCP calls. Credential-like keys (permission token names, auth headers) and core query keys are never allowed.",
+      "type": "object",
+      "additionalProperties": {
+        "type": "object",
+        "additionalProperties": false,
+        "properties": {
+          "type": {
+            "type": "string",
+            "enum": [
+              "string",
+              "number",
+              "boolean"
+            ]
+          },
+          "enum": {
+            "type": "array",
+            "items": {
+              "type": [
+                "string",
+                "number",
+                "boolean"
+              ]
+            }
+          },
+          "maxLength": {
+            "type": "integer",
+            "minimum": 1
+          },
+          "description": {
+            "$ref": "defs.schema.json#/definitions/i18nText"
+          }
+        }
+      }
+    },
     "agent": {
       "description": "Editor- und Agenten-Dokumentation (Zweck, Workflows, Gotchas). Freiform-Doku, wird u.a. ueber MCP/REST _meta ausgespielt.",
       "type": "object",