feat: add mcpctl mcp STDIO bridge, rework config claude

- New `mcpctl mcp -p PROJECT` command: STDIO-to-StreamableHTTP bridge
  that reads JSON-RPC from stdin and forwards to mcplocal project endpoint
- Rework `config claude` to write mcpctl mcp entry instead of fetching
  server configs from API (no secrets in .mcp.json)
- Keep `config claude-generate` as backward-compat alias
- Fix discovery.ts auth token not being forwarded to mcpd (RBAC bypass)
- Update fish/bash completions for new commands
- 10 new MCP bridge tests, updated claude tests, fixed project-discovery test

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

completions/mcpctl.bash

@@ -2,7 +2,7 @@ _mcpctl() {
   local cur prev words cword
   _init_completion || return
 
-  local commands="status login logout config get describe delete logs create edit apply backup restore help"
+  local commands="status login logout config get describe delete logs create edit apply backup restore mcp help"
   local project_commands="attach-server detach-server get describe delete logs create edit help"
   local global_opts="-v --version --daemon-url --direct --project -h --help"
   local resources="servers instances secrets templates projects users groups rbac"
@@ -78,7 +78,7 @@ _mcpctl() {
   case "$subcmd" in
     config)
       if [[ $((cword - subcmd_pos)) -eq 1 ]]; then
-        COMPREPLY=($(compgen -W "view set path reset claude-generate impersonate help" -- "$cur"))
+        COMPREPLY=($(compgen -W "view set path reset claude impersonate help" -- "$cur"))
       fi
       return ;;
     status)
@@ -89,6 +89,8 @@ _mcpctl() {
       return ;;
     logout)
       return ;;
+    mcp)
+      return ;;
     get|describe|delete)
       if [[ -z "$resource_type" ]]; then
         COMPREPLY=($(compgen -W "$resources" -- "$cur"))