feat: support stdio cwd and document Xquik OAuth

[kriptoburak]

Summary

• Add cwd support for config-file stdio servers.
• Forward cwd through hot reload and reconnects into StdioServerParameters.
• Add an OAuth-first Xquik Streamable HTTP example.
• Remove the secret-bearing API-key placeholder from committed JSON.

Closes #288.

Architecture and compatibility

• cwd stays optional and preserves existing config behavior.
• Validation rejects empty or non-string values early.
• Relative and absolute paths follow the MCP Python SDK contract.
• Remote SSE and Streamable HTTP servers remain unchanged.

Validation

• uv run --frozen --python 3.11 pytest -q (34 passed)
• uv run --frozen --python 3.11 python -m compileall -q src
• uv build --no-sources
• Focused Ruff import and format checks
• README config parsing after removing its existing comments
• Live Xquik OAuth issuer, registration, and resource metadata
• GitHub Markdown rendering
• git diff --check

Security

• cwd reaches the SDK as data without shell interpolation.
• The Xquik example uses OAuth dynamic client registration.
• No credential appears in the example or repository.

Changelog Entry

Added

• Add optional cwd support for stdio server configurations.
• Add an OAuth 2.1 Xquik configuration example.

Changed

• Prefer OAuth over a committed bearer-key placeholder for Xquik.

Fixed

• Allow configured stdio child processes to start in their required directory.

[kriptoburak]

I rebuilt this PR on the required dev branch and signed the replacement commit. It now closes the maintainer-endorsed #288 by validating and forwarding stdio cwd through app state, hot reload, reconnects, and the MCP SDK. The Xquik example now uses OAuth dynamic registration, so it no longer encourages a bearer key in committed JSON. All 34 tests pass on Python 3.11, package builds pass, and the README example and live OAuth metadata were validated.