Address review: MCP config dump params + workflow token permissions

- fastmcp _entry_dump now passes entry.translation_params to get_translation
  so {0} placeholders (Spotify callback URL, QR provider name) are substituted
  for MCP clients, matching ConfigEntry.__post_serialize__.
- Add minimal GITHUB_TOKEN permissions to the Lokalise workflows (upload:
  contents:read; download: contents:write + pull-requests:write).

Author: marcelveldt

.github/workflows/lokalise-download.yml

@@ -15,6 +15,11 @@ on:
     - cron: "0 3 * * 2" # every Tuesday at 03:00 UTC
   workflow_dispatch:
 
+# Pushes a branch and opens the translations PR, so it needs write + PR scope.
+permissions:
+  contents: write
+  pull-requests: write
+
 jobs:
   download:
     runs-on: ubuntu-latest

.github/workflows/lokalise-upload.yml

@@ -21,6 +21,10 @@ on:
     - cron: "0 1 * * 2" # weekly safety net, before the Tuesday download run
   workflow_dispatch:
 
+# Only checks out the repo and pushes to Lokalise (via the Lokalise token), so read-only.
+permissions:
+  contents: read
+
 jobs:
   upload:
     runs-on: ubuntu-latest

music_assistant/providers/fastmcp_server/tools/config.py

@@ -116,11 +116,13 @@ def _entry_dump(mass: MusicAssistant, entry: ConfigEntry, current: Any) -> Confi
     base = entry.translation_key or f"config_entries.{entry.key}"
     label = (
         entry.label
-        or mass.translations.get_translation(f"{base}.label", owner=entry.translation_owner)
+        or mass.translations.get_translation(
+            f"{base}.label", owner=entry.translation_owner, params=entry.translation_params
+        )
         or entry.key
     )
     description = entry.description or mass.translations.get_translation(
-        f"{base}.description", owner=entry.translation_owner
+        f"{base}.description", owner=entry.translation_owner, params=entry.translation_params
     )
     return ConfigEntryDump(
         key=entry.key,