chore(mcp): require bearer token for supervisor MCP

The pod now enforces SUPERVISOR_MCP_TOKEN; this matches the .mcp.json
header so a Claude Code session in this repo authenticates correctly.
Token comes from the operator's shell env, not the repo.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.mcp.json

@@ -2,7 +2,10 @@
   "mcpServers": {
     "supervisor": {
       "type": "http",
-      "url": "http://koala:30320/mcp"
+      "url": "http://koala:30320/mcp",
+      "headers": {
+        "Authorization": "Bearer ${SUPERVISOR_MCP_TOKEN}"
+      }
     },
     "brain": {
       "type": "http",