feat: MCP server endpoint with list_services tool (Stories 2.1 + 2.3)

[farovictor]

Summary

• Adds POST /mcp — a JSON-RPC 2.0 MCP server endpoint behind X-API-Key auth
• Supports initialize, tools/list, and tools/call methods
• Implements list_services MCP tool: returns service name + base URL, credentials never included
• Stubs request_key in the tools list (implemented in Story 2.2)
• Wires /mcp in main.go and setupRouter in tests

MCP protocol

POST /mcp
X-API-Key: <key>
Content-Type: application/json

{"jsonrpc":"2.0","id":1,"method":"initialize"}
{"jsonrpc":"2.0","id":2,"method":"tools/list"}
{"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"list_services","arguments":{}}}

Test plan

• 8 new tests pass: auth, initialize, tools/list, list_services (empty + with data + no credential leak), unknown method/tool, invalid jsonrpc version
• go test ./... green
• Manual: curl -X POST http://localhost:3333/mcp -H "X-API-Key: secret" -d '{"jsonrpc":"2.0","id":1,"method":"initialize"}'

🤖 Generated with Claude Code