Reload MCP tokens without restart

[coe0718]

Fixes #16.

What changed

• reload MCP bearer tokens from config/mcp.yaml when the file changes instead of freezing the token map at startup
• use the same file-backed auth behavior for both /mcp and /trigger
• update CLI output and MCP docs so they show a valid initialize request instead of a bare authenticated curl
• add regression tests for middleware reloads, late-added MCP tokens, and late-added /trigger tokens

Why

Issue #16 exposed two separate problems on the MCP side:

• phantom token create could write a valid token that the running server would still reject until restart
• the docs and CLI examples implied that a bare curl -H "Authorization: Bearer ..." /mcp was a valid way to verify a token, even though the streamable HTTP transport requires an initialize request first

This PR fixes the runtime behavior and the guidance at the same time.

Validation

• bun run lint
• bun run typecheck
• bun test