API key support in MCP headers

The MCP endpoint now accepts your API key in standard HTTP headers, specifically X-API-Key or Authorization: Bearer. This provides an alternative to including the key as a ?token= query parameter, offering more flexibility for clients that prefer header-based authentication. The query parameter method remains fully supported.