context-vault-auth: POST /mcp (JWT required)