Drop in-container auth — MetaMCP guards the user-facing edge

The MCP's port 8000 isn't exposed outside the private mcp-servers_mcp
Docker network, so only the MetaMCP gateway can ever reach it. MetaMCP
itself enforces auth at the gateway → MCP-client edge (bearer token in
its UI), which is the right layer for it. In-container Basic/Bearer was
defense-in-depth that turned out to be friction-in-depth.

Removed:
  - ag_bids_mcp/auth.py (HTTP Basic middleware)
  - tests/test_auth.py (3 tests covering the middleware)
  - AG_BIDS_MCP_USER / AG_BIDS_MCP_PASS env vars from .env.example, README,
    docker-compose.snippet.yml, and deploy/README.md

Server.py simplified — direct `mcp.run(transport=...)` like zerto-docs-mcp,
no Starlette wrapping. 21 tests passing.

Live on 192.168.0.2: container recreated, real MCP initialize handshake
returns 200 + capability metadata over the mcp-servers_mcp network with
no auth header.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.env.example

@@ -11,11 +11,6 @@ AG_BIDS_API_URL=https://agbids.paul.farm
 AG_BIDS_API_KEY=
 AG_BIDS_API_TIMEOUT_SECS=20
 
-# --- HTTP Basic auth (REQUIRED — server refuses to start without both) ---
-# These guard the MCP itself. MetaMCP injects them on every upstream call.
-AG_BIDS_MCP_USER=
-AG_BIDS_MCP_PASS=
-
 # --- Per-tool-call usage logging ---
 USAGE_LOG_DIR=/app/var/logs
 USAGE_LOG_KEEP_DAYS=90