MCP: serve tools from the API process over Streamable HTTP at /mcp

- netx_api/mcp_remote: ops / topology / bizMonitor tools, Bearer auth,
  per-tool RBAC filtering, ?groups= filter, readOnlyHint and group meta.
- Mount the official MCP Streamable HTTP app at /mcp (stateless);
  AuthAuditMiddleware is pure ASGI and skips /mcp.
- Let uvicorn chunk MCP responses; some Windows LSPs rewrite
  Content-Length replies on */mcp* paths into broken chunked framing.
- NETX_MCP_ALLOWED_HOSTS opts into DNS-rebinding checks (off by default
  so LAN and reverse-proxy hosts work; Bearer is the gate).
- Remove the three stdio Python MCP packages; tests moved to /mcp,
  including real-TCP framing regressions.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

pyproject.toml

@@ -5,7 +5,7 @@ build-backend = "setuptools.build_meta"
 [project]
 name = "netx-ops"
 version = "0.4.19"
-description = "netx operations tool: alarm-centric workflows with REST API and stdio MCP"
+description = "netx operations tool: alarm-centric workflows with REST API and remote MCP"
 readme = "README.md"
 requires-python = ">=3.11"
 license = { text = "MIT" }
@@ -29,12 +29,11 @@ dependencies = [
   "alembic>=1.13.0",
   "psutil>=5.9.0",
   "redis>=5.0.0",
+  "mcp>=1.0.0",
 ]
 
 [project.optional-dependencies]
-mcp = ["netx-mcp @ file:packages/netx-mcp"]
-mcp-topology = ["netx-topology-mcp @ file:packages/netx-topology-mcp"]
-mcp-bizmonitor = ["netx-bizmonitor-mcp @ file:packages/netx-bizmonitor-mcp"]
+# Remote MCP is built into netx_api (/mcp). Optional extras removed.
 
 [tool.setuptools.packages.find]
 where = ["."]