Drop in-container auth — MetaMCP guards the user-facing edge

The MCP's port 8000 isn't exposed outside the private mcp-servers_mcp
Docker network, so only the MetaMCP gateway can ever reach it. MetaMCP
itself enforces auth at the gateway → MCP-client edge (bearer token in
its UI), which is the right layer for it. In-container Basic/Bearer was
defense-in-depth that turned out to be friction-in-depth.

Removed:
  - ag_bids_mcp/auth.py (HTTP Basic middleware)
  - tests/test_auth.py (3 tests covering the middleware)
  - AG_BIDS_MCP_USER / AG_BIDS_MCP_PASS env vars from .env.example, README,
    docker-compose.snippet.yml, and deploy/README.md

Server.py simplified — direct `mcp.run(transport=...)` like zerto-docs-mcp,
no Starlette wrapping. 21 tests passing.

Live on 192.168.0.2: container recreated, real MCP initialize handshake
returns 200 + capability metadata over the mcp-servers_mcp network with
no auth header.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

deploy/docker-compose.snippet.yml

@@ -1,15 +1,16 @@
 # Standalone docker-compose for ag-bids-mcp.
 #
-# This file is the ENTIRE compose project — it does NOT belong inside
-# zerto-docs-rag's compose. Put it in /home/justin/ag-bids-mcp/ on the
-# MetaMCP host (192.168.0.2) alongside a .env file with three secrets:
+# This file is the ENTIRE compose project — it does NOT belong inside the
+# MetaMCP compose. Put it in /home/justin/ag-bids-mcp/ on the MetaMCP host
+# (192.168.0.2) alongside a .env file with ONE secret:
 #   AG_BIDS_API_KEY    — copy from ag-monitor's .env (BRIEF_API_KEY) on .0.126
-#   AG_BIDS_MCP_USER   — username MetaMCP will send in Basic auth
-#   AG_BIDS_MCP_PASS   — password MetaMCP will send in Basic auth
 #
-# Joins the EXISTING `mcp-servers_mcp` network (created by the MetaMCP
-# compose project at /home/justin/mcp-servers/) as external, so MetaMCP
-# can reach this container by DNS name `ag-bids-mcp`.
+# No in-container auth is needed because port 8000 is never exposed outside
+# the private `mcp-servers_mcp` Docker network — the only client that can
+# reach it is the MetaMCP gateway, which handles auth at the user-facing
+# edge. Joins the EXISTING `mcp-servers_mcp` network (created by the
+# MetaMCP compose project at /home/justin/mcp-servers/) as external so
+# MetaMCP can reach this container by DNS name `ag-bids-mcp`.
 
 services:
   ag-bids-mcp: