Drop in-container auth — MetaMCP guards the user-facing edge

The MCP's port 8000 isn't exposed outside the private mcp-servers_mcp
Docker network, so only the MetaMCP gateway can ever reach it. MetaMCP
itself enforces auth at the gateway → MCP-client edge (bearer token in
its UI), which is the right layer for it. In-container Basic/Bearer was
defense-in-depth that turned out to be friction-in-depth.

Removed:
  - ag_bids_mcp/auth.py (HTTP Basic middleware)
  - tests/test_auth.py (3 tests covering the middleware)
  - AG_BIDS_MCP_USER / AG_BIDS_MCP_PASS env vars from .env.example, README,
    docker-compose.snippet.yml, and deploy/README.md

Server.py simplified — direct `mcp.run(transport=...)` like zerto-docs-mcp,
no Starlette wrapping. 21 tests passing.

Live on 192.168.0.2: container recreated, real MCP initialize handshake
returns 200 + capability metadata over the mcp-servers_mcp network with
no auth header.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

README.md

@@ -28,18 +28,12 @@ for the contract.
 
 ## Authentication
 
-This MCP enforces **HTTP Basic** auth in front of the FastMCP HTTP transport.
-Set both:
+**No in-container auth.** The MCP's port 8000 is never exposed outside the
+private `mcp-servers_mcp` Docker network on `.0.2`. The only client that
+can reach it is MetaMCP, and MetaMCP enforces auth at the gateway → client
+edge (bearer token / OAuth in its UI).
 
-```
-AG_BIDS_MCP_USER=<your username>
-AG_BIDS_MCP_PASS=<your password>
-```
-
-MetaMCP is configured to inject `Authorization: Basic <b64>` on every upstream
-call. Direct access without the header returns `401`.
-
-If either env var is unset the server refuses to start (fail closed).
+This matches the zerto-docs-mcp pattern.
 
 ## Local dev (stdio)
 
@@ -61,18 +55,13 @@ Wire into Claude Desktop's `claude_desktop_config.json`:
       "env": {
         "MCP_TRANSPORT": "stdio",
         "AG_BIDS_API_URL": "https://agbids.paul.farm",
-        "AG_BIDS_API_KEY": "...",
-        "AG_BIDS_MCP_USER": "x",
-        "AG_BIDS_MCP_PASS": "y"
+        "AG_BIDS_API_KEY": "..."
       }
     }
   }
 }
 ```
 
-(The Basic auth check is skipped automatically when `MCP_TRANSPORT=stdio` since
-stdio has no HTTP layer.)
-
 ## Deploy (MetaMCP host)
 
 See [deploy/README.md](deploy/README.md). Container image is pulled from