Pure-ASGI middleware requiring Authorization: Bearer <MCP_API_KEY> on every HTTP
request when MCP_API_KEY is set; open/stdio behaviour preserved when unset.
Closes unauthenticated-MCP exposure (HOME-119 P1).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>