fix(fetch): cap mcp dependency below 2.0

[guptaishaan]

Fixes #4560

mcp 2.0.0 renamed McpError to MCPError, so server.py:6 raises ImportError at
module import and the process exits before the initialize handshake. src/fetch declared
mcp>=1.1.3 with no upper bound, so unpinned launchers like uvx started resolving 2.0.0
as soon as it shipped.

This caps the dependency at mcp>=1.1.3,<2 and regenerates uv.lock. Resolution is
unchanged at mcp 1.23.0, only the recorded specifier moves.

I deliberately did not add an alias import. In 2.0.0 the constructor changed too, from
McpError(ErrorData(code=..., message=...)) to MCPError(code, message, data=None), so
importing MCPError under the old name would import cleanly and then mis-construct all 8
call sites. That trades a loud startup crash for quiet runtime breakage. The real 2.x
migration is a separate job for v2/main per #4475.

Also adds a regression test that parses pyproject.toml and asserts the declared mcp
specifier does not admit 2.0.0. It fails on the unbounded specifier and passes with the
cap. It needs no new dev dependency, packaging already comes in with pytest, and
tomllib is fine because CI reads .python-version, which is 3.11 here.

Verified on Linux, Python 3.11 and 3.12:

• Reproduced the exact traceback from the issue in a clean venv with mcp==2.0.0, same
  line, same Did you mean: 'MCPError'?.
• Confirmed the new test fails before the cap and passes after.
• Fresh unpinned install of the patched package now resolves mcp 1.29.0, and a real stdio
  initialize handshake returns serverInfo mcp-fetch 1.29.0 with exit 0 and empty
  stderr. That matches what the reporter saw with the uvx --with "mcp<2" workaround.
• ruff check and pyright clean. uv lock --check and uv sync --frozen clean.

Not verified: Windows 11 / uv 0.11.8, the reporter's exact environment, and the literal
uvx mcp-server-fetch against a published release rather than a local fresh resolve.
Nothing in the change is platform-sensitive. This patch does not make fetch work on mcp
2.x, it only stops 2.x from being selected.

Unrelated pre-existing failure, present before this change and left alone:
test_empty_content_returns_error fails when Node.js is absent, because readabilipy
falls back to pure-Python mode.

Separately, and not changed here since this issue is scoped to fetch: src/git
(mcp>=1.0.0) and src/time (mcp>=1.23.0) are also unbounded and exposed to the same
resolution.

Thanks to @Jason26214 for the report, which included the root cause, the exact traceback,
and a working uvx --with "mcp<2" workaround.