fix: auto-read user credentials for mcpd auth

mcplocal now reads ~/.mcpctl/credentials automatically when
MCPLOCAL_MCPD_TOKEN env var is not set, matching CLI behavior.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/mcplocal/src/http/config.ts

@@ -1,3 +1,7 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+
 /** Configuration for the mcplocal HTTP server. */
 export interface HttpConfig {
   /** Port for the HTTP server (default: 3200) */
@@ -15,9 +19,24 @@ export interface HttpConfig {
 const DEFAULT_HTTP_PORT = 3200;
 const DEFAULT_HTTP_HOST = '127.0.0.1';
 const DEFAULT_MCPD_URL = 'http://localhost:3100';
-const DEFAULT_MCPD_TOKEN = '';
 const DEFAULT_LOG_LEVEL = 'info';
 
+/**
+ * Read the user's mcpctl credentials from ~/.mcpctl/credentials.
+ * Returns the token if found, empty string otherwise.
+ */
+function loadUserToken(): string {
+  try {
+    const credPath = join(homedir(), '.mcpctl', 'credentials');
+    if (!existsSync(credPath)) return '';
+    const raw = readFileSync(credPath, 'utf-8');
+    const parsed = JSON.parse(raw) as { token?: string };
+    return parsed.token ?? '';
+  } catch {
+    return '';
+  }
+}
+
 export function loadHttpConfig(env: Record<string, string | undefined> = process.env): HttpConfig {
   const portStr = env['MCPLOCAL_HTTP_PORT'];
   const port = portStr !== undefined ? parseInt(portStr, 10) : DEFAULT_HTTP_PORT;
@@ -26,7 +45,7 @@ export function loadHttpConfig(env: Record<string, string | undefined> = process
     httpPort: Number.isFinite(port) ? port : DEFAULT_HTTP_PORT,
     httpHost: env['MCPLOCAL_HTTP_HOST'] ?? DEFAULT_HTTP_HOST,
     mcpdUrl: env['MCPLOCAL_MCPD_URL'] ?? DEFAULT_MCPD_URL,
-    mcpdToken: env['MCPLOCAL_MCPD_TOKEN'] ?? DEFAULT_MCPD_TOKEN,
+    mcpdToken: env['MCPLOCAL_MCPD_TOKEN'] ?? loadUserToken(),
     logLevel: (env['MCPLOCAL_LOG_LEVEL'] as HttpConfig['logLevel'] | undefined) ?? DEFAULT_LOG_LEVEL,
   };
 }