v0.4.0 — MCP Auth Server Template

v0.4.0 makes observability a real, shared client/server boundary and makes the repository easier
to evaluate before adoption.

Use this release with mcp-client-auth-template v0.4.0 for the tested cross-repository profile.

Highlights

a2a-otel-kit[mcp] 0.6 at the production MCP Streamable HTTP ASGI boundary.
Metadata-only W3C trace-context continuation shared with the companion client.
Hardened HTTP admission remains outside tracing; authentication and tool dispatch remain inside.
Deterministic observability shutdown through the MCP server lifespan.
Removal of the disconnected local OpenTelemetry lifecycle and duplicate sanitization policy.
Reworked English and Brazilian Portuguese READMEs for developers, technical leaders, and
engineering reviewers.

Observability remains network-silent unless explicitly enabled with A2A_OTEL_ENABLED=true and
a complete OTLP traces endpoint.
Spans never capture authorization data, arbitrary headers or URLs, MCP arguments/results,
request/response bodies, baggage, or exception text.
Trace context remains correlation metadata and never participates in authentication or
authorization.
The server continues to validate issuer, audience, signature, expiry, identity class, and scopes
before tool dispatch.

Install the normal locked dependency set with uv sync --frozen --all-groups; the old
observability extra no longer exists.
Replace the previous OTEL_* examples with the documented A2A_OTEL_* settings if tracing is
enabled in your deployment.
Disabled observability remains a no-op with no exporter, worker, or telemetry network request.