v2.3.1 — MCP registry manifest, docs consolidation

Packaging, documentation, and release plumbing. No src/ changes, so behaviour is identical to 2.3.0.

This exists as a release rather than a docs commit for one reason: the official MCP Registry verifies PyPI ownership by reading an mcp-name marker out of the package description, PyPI descriptions are immutable once uploaded, and 2.3.0 shipped before the marker existed. Registration needs a version that carries it.

Added

• server.json at the repo root, the manifest for the official MCP Registry.
• An mcp-name ownership marker in the README, which flows into the PyPI description automatically since pyproject.toml sets readme = "README.md".
• An mcp-registry job in publish.yml that publishes to the registry after PyPI on every release. It authenticates with GitHub OIDC so no secret is stored, rewrites the server.json version from the release tag so the manifest cannot drift from the release, and refuses to publish unless the released PyPI description actually carries the marker.

Changed

• BEST_PRACTICES.md moved to docs/BEST_PRACTICES.md and rewritten for 2.3. It had drifted badly: it referenced src/main.py and pre-src-layout module paths, described the gemini/openai/azure provider stack that 2.2 replaced with a single OpenAI-compatible client, said LLM keys could not come from the environment when .env now takes precedence over settings.json, and listed draft mode and x-use doctor as planned when both had shipped. It now covers the queue gate, the proxy MCP tools, cookie expiry checks, and the percent-encoding rule for proxy credentials.
• GitHub Actions moved off the deprecated Node 20 runtime: checkout v4 to v7, setup-python v5 to v7, upload-artifact v4 to v7, download-artifact v4 to v8.
• Em dashes removed throughout the user-facing documentation.

Full detail in CHANGELOG.md. 599 tests passing.