feat: scope query param auth to MCP endpoints

Restrict api_key query parameter to /mcp/tools, /mcp/tool/call,
and /mcp/sse only. Updated documentation to reflect query param
usage for ChatGPT UI without header support.

src/aegis_gitea_mcp/server.py

@@ -74,8 +74,8 @@ async def authenticate_request(request: Request, call_next):
     auth_header = request.headers.get("authorization")
     api_key = auth_validator.extract_bearer_token(auth_header)
 
-    # Fallback: allow API key via query parameter (for ChatGPT UI without headers)
-    if not api_key:
+    # Fallback: allow API key via query parameter only for MCP endpoints
+    if not api_key and request.url.path in {"/mcp/tools", "/mcp/tool/call", "/mcp/sse"}:
         api_key = request.query_params.get("api_key")
 
     # Validate API key