fix: harden MCP endpoint after code review

Critical: the MCP SDK auto-enables DNS-rebinding protection when its host
parameter is left at the 127.0.0.1 default, hard-coding a loopback-only Host
allow-list. Every remote client (the only deployment this feature targets) was
refused with HTTP 421 before auth or the tool ran. Now driven by a new
MCP_ALLOWED_HOSTS setting, with '*' as an explicit, logged opt-out.

Also bounds query/top_k to match AskRequest (top_k is amplified 4x downstream,
so an unbounded value was a resource-exhaustion vector), decodes the
Authorization header as latin-1 per the ASGI spec instead of raising a 500 on
malformed bytes, and returns WWW-Authenticate on 401 per RFC 7235.

Moves the psycopg2 import guard into backend/tests/conftest.py: duplicated
across four test modules, it only worked because of alphabetical collection
order, and any earlier-sorting package would have reintroduced a live
connection attempt against the production database.

Registers the mcp module in the authoritative backend architecture doc.

84 backend tests pass. Verified against a live server: allowed remote Host
returns a valid initialize result, unknown Host returns 421, missing token
returns 401 with WWW-Authenticate.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

.env.example

@@ -166,3 +166,13 @@ AGENTIC_GROUNDING_MAX_TOKENS=250
 # 逗号分隔的允许跨域来源列表，生产环境绝不能使用 *
 CORS_ALLOW_ORIGINS=http://localhost:5173
 
+# ===== MCP (Model Context Protocol) =====
+# MCP 端点（/mcp/）的 Host 头白名单，逗号分隔。MCP SDK 默认开启 DNS rebinding
+# 防护，任何不在此列表中的 Host 都会被直接返回 HTTP 421，请求根本到不了鉴权和
+# 工具逻辑。因此**远程部署必须把真实访问地址写进来**，否则所有外部 MCP 客户端
+# （Claude Desktop / IDE 等）100% 连不上。
+# 语法：`:*` 后缀表示匹配任意端口；填 `*` 表示彻底关闭该防护（不推荐）。
+# 例如部署在 6.86.80.9:8000 时：
+# MCP_ALLOWED_HOSTS=6.86.80.9:*,127.0.0.1:*,localhost:*
+MCP_ALLOWED_HOSTS=127.0.0.1:*,localhost:*,[::1]:*
+