feat(mcp): adopt stateless 2026 protocol and harden authoring

[DavidBabinec]

Summary

• Migrate Instatic's MCP endpoint from the monolithic v1 SDK to @modelcontextprotocol/server v2 and stable MCP 2026-07-28.
• Serve modern, self-contained POST requests through createMcpHandler, including server/discover, per-request _meta, standard routing headers, cancellation, Origin validation, and no protocol session.
• Keep the SDK's stateless 2025 fallback so existing clients can still initialize and issue independent authenticated POSTs during migration.
• Preserve TypeBox as Instatic's schema source while projecting away symbol-keyed runtime metadata before v2 wire validation.
• Fix recurring stress-test failures in atomic tree moves, Content/post-type discovery, outlet element semantics, and font-token style reads.

Why

This builds on the collaboration foundation merged in #305. The stable MCP 2026-07-28 revision removes protocol-level sessions and the initialize handshake in favor of stateless, self-describing requests. The template-masterclass stress campaign also repeatedly exposed a small set of correctness gaps that fit this protocol/authoring hardening pass.

Official references:

• https://modelcontextprotocol.io/specification/2026-07-28
• https://modelcontextprotocol.io/specification/2026-07-28/changelog
• https://github.com/modelcontextprotocol/typescript-sdk/blob/main/docs/migration/support-2026-07-28.md

Root causes fixed

• moveNode inserted a missing source ID into the destination before discovering that no source node existed, leaving a dangling child reference. Source and target are now validated before mutation.
• Site template discovery treated any routable table as a post type; Content discovery advertised page collections the browser Content bridge cannot activate. Both catalogs now match their actual supported surfaces.
• HTML import discarded instatic-outlet tag metadata, causing outlets to default to main and produce nested main landmarks in shared shells. Built-in and custom outlet tags now survive import.
• MCP style reads emitted framework tokens but omitted --font-* declarations because font variables are generated by a separate framework helper. Token-inclusive reads now compose both outputs.

Compatibility and behavior

• Modern requests never create or return Mcp-Session-Id.
• Unsupported modern revisions return MCP -32022; routing-header mismatches return -32020.
• Legacy GET/DELETE session operations return 405 on the stateless endpoint.
• Bearer authentication and the configured public-Origin policy run before SDK dispatch.
• Capability filtering and the live Site/Content editor bridge remain unchanged.

Verification

• bun run build
• bun test — 6,432 passed, 0 failed
• ESLint over every changed TypeScript file
• Focused modern/legacy HTTP conformance, MCP end-to-end, schema-discovery, outlet-import, font-token, and tree-atomicity regression tests
• git diff --check

Repository-wide bun run lint additionally scans ignored local stress scripts under .tmp/template-masterclass; it reports six pre-existing findings in those generated artifacts. Those files are unrelated to and excluded from this PR.