MCP: serve tools from the API process over Streamable HTTP at /mcp

- netx_api/mcp_remote: ops / topology / bizMonitor tools, Bearer auth,
  per-tool RBAC filtering, ?groups= filter, readOnlyHint and group meta.
- Mount the official MCP Streamable HTTP app at /mcp (stateless);
  AuthAuditMiddleware is pure ASGI and skips /mcp.
- Let uvicorn chunk MCP responses; some Windows LSPs rewrite
  Content-Length replies on */mcp* paths into broken chunked framing.
- NETX_MCP_ALLOWED_HOSTS opts into DNS-rebinding checks (off by default
  so LAN and reverse-proxy hosts work; Bearer is the gate).
- Remove the three stdio Python MCP packages; tests moved to /mcp,
  including real-TCP framing regressions.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

mcp_topology_install_payload.json

@@ -1,19 +1,17 @@
 {
-  "source_type": "local",
-  "source_ref": "netx-topology-mcp",
+  "source_type": "remote",
+  "source_ref": "netx-remote-mcp",
   "server_id": "netx-topology",
-  "version": "0.1.0",
-  "entry_command": "python",
-  "entry_args": ["-m", "netx_topology_mcp"],
+  "version": "0.4.19",
+  "transport": "http",
+  "url": "http://127.0.0.1:8890/mcp?groups=topology",
+  "headers": {
+    "Authorization": "Bearer ${NETX_API_TOKEN}"
+  },
   "env_schema": {
-    "NETX_API_URL": {
-      "type": "string",
-      "description": "netx REST API base URL (no trailing slash)",
-      "default": "http://127.0.0.1:8890"
-    },
     "NETX_API_TOKEN": {
       "type": "string",
-      "description": "Optional Bearer token when netx API auth is enabled"
+      "description": "Bearer token (MCP token file or user JWT)"
     },
     "NETX_LANG": {
       "type": "string",