Adds 18 pure-ASGI tests for McpAuthMiddleware and
ContentTypeFixMiddleware. The middleware is the auth gate every MCP
request hits, so this is the highest-leverage 244-line file we had
left at 0% coverage. middleware.py: 0% → 83%. Total project
coverage: 49% → 50% (target met).

Test layout: tests don't spin up Starlette or uvicorn — they invoke
the middleware's __call__(scope, receive, send) directly with
hand-built ASGI scopes and a _RecordingApp inner app that records
whether it was called. A _drive helper collects every send message
so tests can assert on status / headers / body without a live event
loop.

McpAuthMiddleware coverage:
- websocket scope passes through (non-HTTP)
- /.well-known/... bypasses auth (OAuth discovery)
- /health bypasses auth
- /admin/... bypasses (AdminAuthMiddleware handles it)
- disallowed Origin → 403 with no inner-app call
- auth_required=False bypasses every gate
- /mcp without bearer token → 401 with proper WWW-Authenticate:
  Bearer resource_metadata="..." header
- /mcp + valid HS256 JWT → forwards to inner app
- static bearer token (STATIC_BEARER_TOKENS) accepted without JWT
  verification
- blacklisted JTI in DB → 401
- garbage JWT → 401
- /mcp/<server> tools/call without token → 401, but initialize
  passes through pre-auth for handshake
- trusted_ips bypasses tools/call token requirement
- tools/list response is buffered and gets securitySchemes with
  oauth2 + parsed scopes injected into every tool

ContentTypeFixMiddleware coverage:
- POST /mcp with application/octet-stream rewritten to
  application/json
- non-/mcp paths pass through unchanged
- websocket scopes pass through

244 + 18 = 262 tests pass. mypy still 0.