v2.1.0 — TLS backend verification (C6)

Security

C6 — TLS NUC↔VM encryption

• New MCP_CA_CERT env var: path to backend self-signed cert for httpx verification
• httpx.AsyncClient(verify=MCP_CA_CERT) — full TLS cert verification when set
• Falls back to verify=True (system CAs) when unset

Compatible with hugo-mcp v1.9.0 which runs uvicorn with --ssl-certfile / --ssl-keyfile.