fix(mcp): replace SeerrAPIKeyMiddleware with MCPAuthMiddleware

[electather]

Summary

Fixes a bug where MCP HTTP clients with no auth config received a 401 even when the server was started without --auth-token.

SeerrAPIKeyMiddleware was incorrectly treating the X-Api-Key request header as the Seerr API key and rejecting requests that didn't supply one. In reality, X-Api-Key on the MCP endpoint is for client authentication (an alternative to Authorization: Bearer), checked against --auth-token. The Seerr API key is always read from the application config (seerr.api_key) and never sourced from the incoming request.

Changes

• Remove SeerrAPIKeyMiddleware entirely
• Replace bearerAuthMiddleware with MCPAuthMiddleware(token, allowQueryParam, next) that accepts the configured auth token via:
  1. Authorization: Bearer <token>
  2. X-Api-Key: <token>
  3. ?api_key=<token> (when --allow-api-key-query-param is set)
• Fix --allow-api-key-query-param flag description: it passes the MCP auth token, not the Seerr API key
• Rewrite mcp_api_key_middleware_test.go with tests covering all three credential methods, wrong tokens, disabled query params, and the no-auth pass-through scenario

Test plan

• go test -v ./... passes
• go fmt ./... produces no diff
• go build succeeds
• Start server with --no-auth and connect a client with no credentials — expect 200, not 401
• Start server with --auth-token secret and send X-Api-Key: secret — expect 200
• Start server with --auth-token secret and send wrong key — expect 401

Checklist

• New tests added for new behaviour
• Documentation updated (README, command --help, comments)
• No unrelated changes included