[codex] Add MCP bridge auth token

[CompleteDotTech]

Summary

Adds optional auth-token support to the Python MCP bridge without changing the game/mod HTTP server behavior.

Changes

• Loads bridge settings from mcp/.env or the process environment while preserving environment-variable precedence.
• Sends STS2_MCP_AUTH_TOKEN as an Authorization: Bearer ... header on all bridge HTTP requests when configured.
• Documents the new bridge setting and ignores local .env files so tokens are not committed.
• Adds focused MCP bridge tests for dotenv precedence and auth header injection.

Validation

• uv run --directory mcp python ../scripts/test_mcp_server.py
• uv run --directory mcp python -m py_compile server.py ../scripts/test_mcp_server.py
• uv run --directory mcp python server.py --help
• git diff --cached --check

[gemini-code-assist]

Code Review

This pull request introduces support for loading environment variables from .env files and implements Bearer token authentication for the MCP server's HTTP client. The changes include a custom .env parser, updates to the httpx client configuration, and corresponding test cases. Feedback was provided regarding the .env parsing logic, specifically suggesting a more robust way to handle inline comments to avoid truncating tokens that contain a # character.

[gemini-code-assist]

The current logic for stripping inline comments is quite aggressive and will truncate any value containing a # character, even if it's part of the token itself (e.g., STS2_MCP_AUTH_TOKEN=my#token). Standard .env parsers typically require at least one whitespace character before the # to treat it as an inline comment. Consider requiring a space to avoid accidental truncation of valid tokens.

Suggested change

	if "#" in value:
	value = value.split("#", 1)[0].rstrip()
	if " #" in value:
	value = value.split(" #", 1)[0].rstrip()