feat: add --http transport with bearer-token auth

Adds a StreamableHTTPServerTransport-backed --http mode alongside the
existing stdio transport, gated by verifyBearerToken (Task 1). Serves
MCP at /mcp on 127.0.0.1:${MCP_HTTP_PORT:-3000}; requires
MCP_HTTP_TOKEN and rejects unauthenticated requests with 401.

index.js now builds a fresh Server+StreamableHTTPServerTransport pair
per HTTP request (factored into createMcpServer()) rather than reusing
one shared instance, matching the SDK's own stateless-transport
example: Server#connect() throws "Already connected to a transport" if
reused before the previous transport's close() has unset it, so a
single shared instance breaks on any request after the first.

Also fixes a pre-existing test.js bug where the "integration" describe
block's afterEach did `delete globalThis.fetch` instead of restoring
the captured realFetch reference -- since Node's global fetch is a
lazily-initialized property that doesn't come back after being deleted
once overwritten, this permanently broke the bare `fetch` global for
every describe block that runs afterward in the same process,
including the new HTTP transport tests.

ci: update GitHub Actions to checkout@v6

ci: publish to GitHub Packages registry

docs: add raw path docs reference

chore(release): configure npm publishing

docs: update test count to 250

docs: use pnpm dlx in supergateway example

test: add real server placeholder integration

chore: update README.md, config.yaml, docs/raw-path-placeholders.md

docs: fill CLAUDE.md gaps (conventions, security, testing, patterns)