feat(mcp): port the server to MCP Python SDK v2 (FastMCP → MCPServer) (#2196)

- server.py: `mcp.server.mcpserver.MCPServer`; StrictArgsFastMCP becomes
  StrictArgsMCPServer, whose call_tool takes and forwards v2's `context`
  and raises ToolError (the SDK logs anything else as an unexpected crash;
  the message reaches the caller either way).
- stateless_http and transport_security moved from the constructor to
  `streamable_http_app(...)` in mount_mcp, with their reasons.
- Per-request user identity is unchanged: the contextvar set around the
  ASGI call reaches the handler on both v2 paths (legacy stateless spawns
  from the request task; the 2026-07-28 modern path opens its task group
  inside the request).
- pyproject: mcp[cli]>=2.2, no ceiling (installs are --locked). uv.lock
  regenerated with --upgrade-package mcp in the ci-python image: only mcp
  and its own dependencies moved (106 → 110 packages).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/scribe/mcp/tools/__init__.py

@@ -1,7 +1,7 @@
 """MCP tool implementations.
 
 Each tool module exposes a `register(mcp)` function that attaches its tools
-to a FastMCP instance. `register_all(mcp)` is the single entry point called
+to an MCPServer instance. `register_all(mcp)` is the single entry point called
 from `mcp.server.build_mcp_server`.
 """
 from scribe.mcp.tools import (
@@ -13,7 +13,7 @@ from scribe.mcp.tools import (
 
 
 def register_all(mcp) -> None:
-    """Register every tool module's tools on the given FastMCP instance."""
+    """Register every tool module's tools on the given MCPServer instance."""
     search.register(mcp)
     retrieval_tuning.register(mcp)
     wide_net.register(mcp)

src/scribe/mcp/tools/tasks.py

@@ -537,7 +537,7 @@ _ITEM_KEYS = {"title", "body", "type", "status", "priority", "kind", "tags", "sy
 def _batch_items(records: list[dict], *, what: str = "record") -> list[batch_svc.BatchItem]:
     """Parse the door's plain dicts into BatchItems, refusing unknown keys.
 
-    Strict for the same reason StrictArgsFastMCP is (#2709): a misspelt key
+    Strict for the same reason StrictArgsMCPServer is (#2709): a misspelt key
     silently dropped — `milestone` for a per-record milestone, `desc` for body —
     creates a record that looks right and is missing what the caller sent.
     """