Add HTTP transport with OAuth, Redis state, and deploy config

[RafaelPo]

Summary

Adds HTTP (Streamable HTTP) transport mode to the everyrow MCP server, enabling remote deployment with OAuth 2.1 authentication, Redis-backed state, and a Docker deploy stack.

New modules

• auth.py — OAuth 2.1 provider (3-leg PKCE: Google → Supabase → MCP Server), JWKS verification, refresh token rotation
• http_config.py — HTTP mode setup: OAuth wiring, custom routes, CSP, middleware
• routes.py — REST endpoints for progress polling and CSV download (bypasses MCP protocol for widgets)
• middleware.py — Redis-based fixed-window rate limiter per client IP
• result_store.py — Redis-backed result caching with pagination and CSV download URLs
• redis_utils.py — Redis client factory with Sentinel support
• config.py — HttpSettings, DevHttpSettings, StdioSettings with _BaseHttpSettings base class
• state.py — ServerState with Transport enum, RedisStore, validate_assignment=True
• tool_helpers.py — Transport-aware helpers (_get_client, create_tool_response, _write_task_state)
• tool_descriptions.py — Per-transport tool description patching
• templates.py — MCP App widget HTML (progress, results, session)

Other changes

• everyrow_single_agent — New MCP tool for single-question research (no CSV required)
• input_data / input_json — All submit tools now accept inline data (not just input_csv)
• create_tool_response() — Deduplicated submission return pattern across all 6 submit tools
• Deploy stack — Dockerfile, docker-compose.yaml, .env.example
• Docs/README — Clinical trials case study edits, classification guide CSV fix, README updates

Stdio impact

• No breaking changes — all existing stdio tool signatures and behavior preserved
• Field descriptions restored where shortened (equivalence_relation, merge fields, output_path)
• New hard dependencies (redis, httpx, PyJWT, pydantic-settings) loaded at module level in both modes

Architecture decisions

• Settings are lazy singletons (@lru_cache getters), not on ServerState
• ServerState has validate_assignment=True — rejects invalid transport values
• Dead fields removed: auth_provider (write-only), dev_mode, settings property
• is_http uses closed-form == Transport.HTTP check
• Middleware ordering: logging wraps rate limiting (sees all requests including 429s)
• _submission_ui_json() only called in HTTP mode (avoids wasted Redis writes in stdio)

Test plan

• 192 unit tests pass (uv run pytest tests/ -v)
• 7 integration tests pass with real API (RUN_INTEGRATION_TESTS=1)
• Ruff lint + format clean
• Pyright typecheck clean
• Manifest sync test passes (docstrings match manifest.json)
• Manual stdio smoke test (Claude Desktop)
• Manual HTTP smoke test (--http --no-auth)

🤖 Generated with Claude Code

[RafaelPo]

@claude code review

[sentry]

Bug: When offset equals total rows, the pagination summary message becomes nonsensical, e.g., 'showing rows 101-100 of 100'.
_{Severity: MEDIUM}

Suggested Fix

Add a conditional check at the beginning of the else block in _build_result_response. If offset >= total, return a specific message indicating that there are no more rows to show, rather than attempting to calculate and display a row range.

Prompt for AI Agent

Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.

Location: everyrow-mcp/src/everyrow_mcp/result_store.py#L134-L138

Potential issue: When a user requests a page with an `offset` equal to or greater than
the `total` number of rows, the `_build_result_response` function generates a
nonsensical summary message. For example, if `offset` and `total` are both 100, the
message becomes "showing rows 101-100 of 100 (final page)". While the function correctly
returns an empty set of rows, the accompanying text is confusing for the user. This can
occur because the `offset` parameter in `HttpResultsInput` is only validated to be
non-negative, allowing users to paginate past the end of the dataset.