#62 FTX-62: MCP Streamable HTTP transport + per-request auth

StreamableHTTPSessionManager(stateless=True) mounted at /mcp with auth ASGI wrapper (Bearer -> authenticate -> request-scoped contextvar); delete SSE GET/POST routes (fixes cross-tenant ContextVar leak); 401/403/503 JSON on failure (UB-MCP-1/2). Test: concurrent two-tenant no-bleed. Phase 5.