feat(mcp): support caller-owned dynamic HTTP authentication

[Yuang-Deng]

Problem and change

Remote MCP servers using expiring OAuth credentials cannot use static headers for long-running tools. Add optional asynchronous header and recovery callbacks to MCPClient for Streamable HTTP, so the caller retains ownership of credentials and refresh policy.

A new connection obtains current headers. An explicit HTTP 401 can trigger one recovery and retry; tool failures/timeouts and failures during cleanup after a successful call do not replay the operation. Redirects with dynamic authentication callbacks are rejected before the SDK can follow them; static headers retain SDK redirect behavior. Existing static authentication transports remain unchanged.

Validation

• 9 MCP authentication tests passed, including real local HTTP handshake, 401 recovery, OAuth redirect rejection, static API-key same-origin 307 discovery/calls, and no replay after cleanup failure. Changed files pass the repository flake8 configuration.
• Live Notion DCR/browser authorization through the LazyMind integration: discovered 45 tools, searched workspace content and fetched a document.

The branch now includes main. The dependent LazyMind PR has also synchronized main and adopted the host-file API changes; it remains draft until this dependency is merged.

Python 3.10 validation: the previously failing lint now passes using the existing AnyIO exceptiongroup backport, and all 9 MCP auth tests pass with MCP SDK 1.30.0. No new production dependency was added. SDK 2.2.0 was also probed: it converts the real HTTP 401 into MCPError, so the current explicit HTTP-status recovery does not recover that case. LazyMind constrains MCP to <2; SDK 2 recovery is outside this change.