MCP: serve tools from the API process over Streamable HTTP at /mcp

- netx_api/mcp_remote: ops / topology / bizMonitor tools, Bearer auth,
  per-tool RBAC filtering, ?groups= filter, readOnlyHint and group meta.
- Mount the official MCP Streamable HTTP app at /mcp (stateless);
  AuthAuditMiddleware is pure ASGI and skips /mcp.
- Let uvicorn chunk MCP responses; some Windows LSPs rewrite
  Content-Length replies on */mcp* paths into broken chunked framing.
- NETX_MCP_ALLOWED_HOSTS opts into DNS-rebinding checks (off by default
  so LAN and reverse-proxy hosts work; Bearer is the gate).
- Remove the three stdio Python MCP packages; tests moved to /mcp,
  including real-TCP framing regressions.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

mcp.json

@@ -1,23 +1,9 @@
 {
   "mcpServers": {
     "netx": {
-      "command": "python",
-      "args": ["-m", "netx_mcp"],
-      "env": {
-        "NETX_API_URL": "http://127.0.0.1:8890",
-        "NETX_LANG": "zh",
-        "PYTHONIOENCODING": "utf-8",
-        "PYTHONUTF8": "1"
-      }
-    },
-    "netx-topology": {
-      "command": "python",
-      "args": ["-m", "netx_topology_mcp"],
-      "env": {
-        "NETX_API_URL": "http://127.0.0.1:8890",
-        "NETX_LANG": "zh",
-        "PYTHONIOENCODING": "utf-8",
-        "PYTHONUTF8": "1"
+      "url": "http://127.0.0.1:8890/mcp",
+      "headers": {
+        "Authorization": "Bearer ${NETX_API_TOKEN}"
       }
     }
   }