feat: Implement MCP authentication and security enhancements

[AlexMikhalev]

Summary

Implement comprehensive MCP authentication system based on closed PR #287.

Design Plan

See .docs/plans/mcp-authentication-design.md for full design document.

Key Features

1. Authentication Middleware: Bearer token validation with SHA256 hashing
2. Three-Layer Security: exists + enabled + expiration validation
3. Rate Limiting: Configurable request limits with sliding window
4. Security Logging: Comprehensive audit trail for attack detection

Implementation Phases

Phase	Duration	Deliverable
Phase 1: Foundation	2 days	Auth module structure, token validator
Phase 2: Middleware	2 days	Working auth on SSE routes
Phase 3: Rate Limiting	1 day	Sliding window implementation
Phase 4: Hardening	2 days	Logging, tests, documentation

Acceptance Criteria

• Request without Authorization header returns 401
• Request with invalid/expired token returns 401
• Request exceeding rate limit returns 429
• Valid token allows tool invocation
• Security events logged with timestamp, IP, token_id
• Stdio transport works without token (backward compatible)

Origin

Based on closed PR #287 which had conflicts with current codebase. Fresh implementation approach.

Labels

security, enhancement, mcp