fix(http-auth): I12 wire StaticTokenVerifier into FastMCP when MCP_AUTH_TOKEN is set

Before: _validate_http_bind warned about MCP_AUTH_TOKEN being required for
remote HTTP but the token was never passed to the FastMCP constructor, so the
server accepted any request without authentication.

After: a StaticTokenVerifier is built at module load if MCP_AUTH_TOKEN is set
and passed as auth= to FastMCP(). Loopback-only deployments (no token set)
continue to work as anonymous mode.

7 new tests in tests/test_http_auth.py covering: token present/absent, mcp
instance wiring, loopback/remote bind guard, remote-without-token rejection.

233 tests total.

server.py

@@ -21,6 +21,7 @@ from typing import Annotated, Any
 
 from fastmcp import Context, FastMCP
 from fastmcp.exceptions import ToolError
+from fastmcp.server.auth import StaticTokenVerifier
 from fastmcp.server.lifespan import lifespan
 from fastmcp.server.middleware import Middleware, MiddlewareContext
 from fastmcp.server.middleware.error_handling import ErrorHandlingMiddleware
@@ -146,12 +147,30 @@ class AuditMiddleware(Middleware):
             raise
 
 
+# ---------------------------------------------------------------------------
+# HTTP auth
+# ---------------------------------------------------------------------------
+
+_auth = (
+    StaticTokenVerifier(
+        tokens={
+            config.settings.mcp_auth_token: {
+                "client_id": "mcp-http-client",
+                "scopes": ["mcp:read", "mcp:write"],
+            }
+        }
+    )
+    if config.settings.mcp_auth_token
+    else None
+)
+
 # ---------------------------------------------------------------------------
 # FastMCP server
 # ---------------------------------------------------------------------------
 
 mcp = FastMCP(
     name="AutoCAD MCP Pro",
+    auth=_auth,
     instructions="""
 AutoCAD MCP Pro provides complete AutoCAD automation through a large tool surface.