feat(ingestion): add bearer token auth middleware for MCP endpoint

ingestion/cmd/server/main.go

@@ -57,6 +57,12 @@ func main() {
 
 	mcpSrv := mcp.NewServer(brainDir, &pipelineCfg, llmClient.Complete)
 
+	mcpToken := os.Getenv("BRAIN_MCP_TOKEN")
+	if mcpToken == "" {
+		logger.Error("BRAIN_MCP_TOKEN not set")
+		os.Exit(1)
+	}
+
 	ctx := context.Background()
 	if watchInterval > 0 {
 		watcher.Start(ctx, watcher.Config{
@@ -74,7 +80,7 @@ func main() {
 	mux.HandleFunc("POST /ingest-raw", h.IngestRaw)
 	mux.HandleFunc("POST /backfill-refs", h.BackfillRefs)
 	mux.HandleFunc("GET /pass-rate", h.PassRate)
-	mux.Handle("POST /mcp", mcpSrv)
+	mux.Handle("POST /mcp", mcp.BearerAuth(mcpToken, mcpSrv))
 
 	addr := ":" + port
 	watchIntervalLog := "disabled"