require a bearer token on the MCP HTTP server (T-362)

D-71's threat model — another user on the same host must not drive my
IDE — was enforced with 0600 on the unix socket and then bypassed
wholesale by the unauthenticated localhost SSE port, which since D-86
serves every clide verb as a tool. The server now mints 32 bytes of
CSPRNG token per start, publishes it via the /ide discovery lock
file's authToken slot (the field Claude Code's client reads), chmods
the lock to 0600, and rejects any request that doesn't present the
token in x-claude-code-ide-authorization with 401.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

CHANGELOG.md

@@ -92,6 +92,11 @@ heading, and (b) bumping `pubspec.yaml` `version:` in the same commit.
 
 ### Security
 
+- **The MCP HTTP server now requires a per-start auth token.** The localhost
+  SSE port served the entire clide command surface unauthenticated,
+  bypassing the unix socket's 0600 gate; requests must now present the
+  token published in the 0600 `/ide` lock file. (T-362)
+
 - **`editor.open` / `editor.save` are now workspace-confined.** Both verbs
   accepted absolute paths and `..` traversal verbatim — an unconfined read
   and write primitive over IPC. They now pass the same path-safety guard as