Performance, correctness, and security release. Eleven PRs since 2.3.7.

Highlights:
- get_alert_by_short_id 41s spikes -> ~200ms (direct point GET)
- get_oncall_handoff_summary ~15s -> ~1-2s (parallel fan-out)
- _fetch_users_and_schedules_maps cold cache ~15s -> ~1s (parallel + page fan-out)
- get_oncall_shift_metrics silent data-loss bug fixed (was only paginating page 1)
- Bearer auth enforced and validated against upstream API before MCP access
- urllib3 / python-multipart / pip bumped for five open advisories

Full notes in CHANGELOG.