fix: MCP server polish — version from package.json, Streamable HTTP transport, auth

[OneStepAt4time]

M1.5 — Quality + Polish

Parent: #440 (Roadmap)
Milestone: M1 — MCP Server Complete
Depends on: #444 (testing must be green first)

Tasks

1. VERSION from package.json — currently hardcoded to 1.2.0 in mcp-server.ts. Read from package.json at runtime.
2. Streamable HTTP transport — add --transport http option alongside stdio for remote access. Use @modelcontextprotocol/sdk/server/streamable-http.js.
3. Auth token forwarding — MCP server should accept AEGIS_TOKEN env var and forward to REST API. Currently partially implemented.
4. Error format consistency — MCP tool errors should match REST API error envelope (code, message, details).
5. Graceful degradation — if REST server is down, MCP tools should return clear error, not crash.

Acceptance criteria

• aegis-bridge mcp --version shows correct version from package.json
• aegis-bridge mcp --transport http --port 8080 starts Streamable HTTP server
• AEGIS_TOKEN=xxx aegis-bridge mcp forwards auth
• All tests still green