feat(mcp): port the server to MCP Python SDK v2 (FastMCP → MCPServer) (#2196)

- server.py: `mcp.server.mcpserver.MCPServer`; StrictArgsFastMCP becomes
  StrictArgsMCPServer, whose call_tool takes and forwards v2's `context`
  and raises ToolError (the SDK logs anything else as an unexpected crash;
  the message reaches the caller either way).
- stateless_http and transport_security moved from the constructor to
  `streamable_http_app(...)` in mount_mcp, with their reasons.
- Per-request user identity is unchanged: the contextvar set around the
  ASGI call reaches the handler on both v2 paths (legacy stateless spawns
  from the request task; the 2026-07-28 modern path opens its task group
  inside the request).
- pyproject: mcp[cli]>=2.2, no ceiling (installs are --locked). uv.lock
  regenerated with --upgrade-package mcp in the ci-python image: only mcp
  and its own dependencies moved (106 → 110 packages).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/scribe/mcp/_context.py

@@ -1,7 +1,7 @@
 """Per-request MCP context.
 
 The ASGI middleware (mcp/server.py) populates `_user_id_ctx` from
-scope['scribe_user_id'] before dispatching to FastMCP tool handlers.
+scope['scribe_user_id'] before dispatching to MCPServer tool handlers.
 Tool functions then call `current_user_id()` to retrieve it.
 
 Tools must never fall back to a default user — `current_user_id()` raises