feat: add mcpctl mcp STDIO bridge, rework config claude

- New `mcpctl mcp -p PROJECT` command: STDIO-to-StreamableHTTP bridge
  that reads JSON-RPC from stdin and forwards to mcplocal project endpoint
- Rework `config claude` to write mcpctl mcp entry instead of fetching
  server configs from API (no secrets in .mcp.json)
- Keep `config claude-generate` as backward-compat alias
- Fix discovery.ts auth token not being forwarded to mcpd (RBAC bypass)
- Update fish/bash completions for new commands
- 10 new MCP bridge tests, updated claude tests, fixed project-discovery test

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/mcplocal/src/discovery.ts

@@ -35,7 +35,7 @@ export async function refreshProjectUpstreams(
   let servers: McpdServer[];
   if (authToken) {
     // Forward the client's auth token to mcpd so RBAC applies
-    const result = await mcpdClient.forward('GET', path, '', undefined);
+    const result = await mcpdClient.forward('GET', path, '', undefined, authToken);
     if (result.status >= 400) {
       throw new Error(`Failed to fetch project servers: ${result.status}`);
     }

src/mcplocal/tests/project-discovery.test.ts

@@ -54,7 +54,7 @@ describe('refreshProjectUpstreams', () => {
     const client = mockMcpdClient(servers);
 
     await refreshProjectUpstreams(router, client as any, 'smart-home', 'user-token-123');
-    expect(client.forward).toHaveBeenCalledWith('GET', '/api/v1/projects/smart-home/servers', '', undefined);
+    expect(client.forward).toHaveBeenCalledWith('GET', '/api/v1/projects/smart-home/servers', '', undefined, 'user-token-123');
     expect(router.getUpstreamNames()).toContain('grafana');
   });