feat: add MCP server module exposing search_regulations tool

- New backend/app/mcp/ module: MCPServer instance with a single
  search_regulations tool backed by the existing AgentConversationService.
- MCPAuthMiddleware reuses existing JWT auth (no new auth mechanism).
- Mounted at /mcp/ in api/main.py via Streamable HTTP transport; wired the
  MCP session manager into the existing lifespan() via AsyncExitStack
  (app.mount() does not propagate nested ASGI lifespans automatically).
- Fixed a doubled /mcp/mcp path by setting streamable_http_path to "/"
  (MCPServer.streamable_http_app() defaults to registering its own /mcp route).
- Verified end-to-end with the real mcp Python client: list_tools() returns
  search_regulations, auth correctly 401s without or with an invalid token.
- 7 new tests, 76 total (up from 69), all passing.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

backend/app/mcp/__init__.py

@@ -0,0 +1,8 @@
+"""MCP (Model Context Protocol) server module.
+
+Exposes selected read-only platform capabilities — currently only regulation
+search — as MCP tools so external MCP clients (Claude Desktop, GitHub Copilot,
+Cursor, etc.) can query this platform's compliance knowledge base directly.
+"""
+# Kept deliberately empty beyond this docstring — see server.py for the
+# actual FastMCP instance and tool/middleware definitions.