feat(ingestion): add bearer token auth middleware for MCP endpoint

ingestion/internal/mcp/auth.go

@@ -0,0 +1,23 @@
+package mcp
+
+import (
+	"net/http"
+	"strings"
+)
+
+// BearerAuth returns a middleware that enforces a static bearer token on every
+// request. token must be non-empty; if it is empty, every request is rejected.
+func BearerAuth(token string, next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if token == "" {
+			http.Error(w, "unauthorized", http.StatusUnauthorized)
+			return
+		}
+		got := strings.TrimPrefix(r.Header.Get("Authorization"), "Bearer ")
+		if got != token {
+			http.Error(w, "unauthorized", http.StatusUnauthorized)
+			return
+		}
+		next.ServeHTTP(w, r)
+	})
+}