feat: scope query param auth to MCP endpoints

Restrict api_key query parameter to /mcp/tools, /mcp/tool/call,
and /mcp/sse only. Updated documentation to reflect query param
usage for ChatGPT UI without header support.

AUTH_SETUP.md

@@ -77,9 +77,12 @@ API key authentication ENABLED (1 key(s) configured)
 # Without key - should fail with 401
 curl https://mcp.yourdomain.com/mcp/tools
 
-# With valid key - should succeed
+# With valid key (header) - should succeed
 curl -H "Authorization: Bearer YOUR_KEY_HERE" \
      https://mcp.yourdomain.com/mcp/tools
+
+# With valid key (query param) - should succeed
+curl "https://mcp.yourdomain.com/mcp/tools?api_key=YOUR_KEY_HERE"
 ```
 
 ---