Require auth for local MCP API

[Daliys]

Summary

• require a per-session token before HTTP/WebSocket JSON-RPC dispatch
• pass the token through generated MCP configs and the Python bridge
• mark stale client configs outdated when the auth token is missing or stale
• update docs and README examples for the auth header/env

Validation

• PYTHONDONTWRITEBYTECODE=1 scripts/prepush-validate.sh --static-only
• pre-push hook: static validation plus quick live server smoke

Fixes #62