shared-bot-service: MCP endpoint at /mcp (bearer token required)