find_ip_address(all_regions=True) fails entirely if a single region is inaccessible (e.g. SCP deny)

Description

find_ip_address with all_regions=True is documented to search "across all enabled regions in your account" until the IP is found. In practice, if the calling role is denied ec2:DescribeNetworkInterfaces in even one of the account's enabled regions (e.g. via an AWS Organizations SCP restricting a specific region, or a permission boundary), the entire multi-region search fails outright instead of skipping that region and continuing to the next.

Environment

• awslabs.aws-network-mcp-server version: 0.0.13 (via uvx awslabs.aws-network-mcp-server@latest)
• MCP client: Claude Code
• Region making the call: eu-west-1 (account has 5 enabled regions total)

Steps to reproduce

1. Have an IAM role where ec2:DescribeNetworkInterfaces is explicitly denied by an SCP for at least one of the account's enabled regions, but allowed in others.
2. Call find_ip_address(ip_address="<ip>", region="<any-allowed-region>", all_regions=True, profile_name="<profile>").

Actual behavior

Error searching IP address in all regions: An error occurred (UnauthorizedOperation) when calling the DescribeNetworkInterfaces operation: You are not authorized to perform this operation. User: <role-arn> is not authorized to perform: ec2:DescribeNetworkInterfaces with an explicit deny in a service control policy: <scp-arn>. REQUIRED TO REMEDIATE BEFORE CONTINUING

The search aborts completely on the first denied region, even though the IP might be found (or the search could at least complete) in the other 4 enabled regions.

Expected behavior

When all_regions=True, a region that returns AccessDenied/UnauthorizedOperation should be skipped (with a warning noted in the response, e.g. "regions_skipped": ["<region>"]) rather than aborting the entire search. This makes the tool usable in accounts with per-region SCP restrictions, which is a common pattern in regulated/enterprise AWS Organizations.

Additional context

This isn't a bug in the sense of incorrect AWS API usage — the deny is coming from the account's own SCP, which the tool has no control over. But since all_regions=True is explicitly documented as a convenience for "search until found," a single inaccessible region shouldn't be able to break that convenience entirely. Happy to help test a fix if useful.