🔓 feat: simplify local usage with SERVER_AUTH_DISABLED mode — all tests pass

[Falamarcao]

The goal? Make it dead simple to run the MCP server locally

This PR introduces a lightweight, intentional bypass for local use:

✅ How it works

Set API_TOKEN=SERVER_AUTH_DISABLED → authentication is skipped, and all requests are accepted as anonymous.

That’s it. No API key needed. Just paste the mcp.json and go.

if settings.API_TOKEN.get_secret_value() == "SERVER_AUTH_DISABLED":
        logger.critical(
            "API_TOKEN is disabled — skipping token verification, access granted as anonymous".upper()
        )
        return {"sub": "anonymous"}