feat: accept per-client API keys from an HTTP header

When serving over HTTP, the key sent in the MCP_API_KEY_HEADER header
(default X-API-Key) is used as the API credential for that request and
takes precedence over the static API_TOKEN. The key is formatted with
API_AUTH_HEADER/API_AUTH_SCHEME and the source header is stripped from
the outgoing API request. Implemented as an httpx2 auth flow over
FastMCP's request context, so concurrent clients stay isolated.

.env.example

@@ -21,6 +21,11 @@ OPENAPI_SPEC_URL=https://petstore3.swagger.io/api/v3/openapi.json
 # Send the raw token with no scheme prefix by setting this to an empty value:
 #API_AUTH_SCHEME=
 
+# HTTP header treated as the per-request API key of the MCP client. When
+# present it takes precedence over API_TOKEN. Set to an empty value to disable
+# the mapping (default: X-API-Key).
+#MCP_API_KEY_HEADER=X-API-Key
+
 # --- MCP server ---------------------------------------------------------------
 # stdio or http (streamable-http is accepted as an alias); default: stdio
 MCP_TRANSPORT=http