fix(deps): bump mcp to 1.28.1 to clear 3 high-severity CVEs (#2348)

## Description

Clears **all 3 open Dependabot alerts** (and the `pip-audit` CI failure)
— every one is `mcp 1.26.0` in `uv.lock`:

| Alert | CVE | Issue | Fix |
|-------|-----|-------|-----|
| #155 | CVE-2026-52870 | experimental task handlers leak cross-session
tasks | 1.27.2 |
| #156 | CVE-2026-52869 | HTTP transports serve session requests without
auth check | 1.27.2 |
| #157 | CVE-2026-59950 | deprecated WebSocket transport lacks
Host/Origin validation | 1.28.1 |

`mcp 1.28.1` satisfies all three.

Closes #

## Type of Change
- [x] Bug fix (security / dependency)

## Changes Made
- `pyproject.toml`: raise the floor `mcp>=1.0.0` → `mcp>=1.28.1` (core
dep **and** the `[mcp]` extra).
- `uv.lock`: bump the `mcp` entry `1.26.0` → `1.28.1` (version +
sdist/wheel URL, sha256, size from PyPI).

**Surgical on purpose.** mcp 1.28.1's resolved dependency set is
unchanged for this project's Python range (1.26 vs 1.28.1 differ only in
`python_version>=3.14` conditionals and an httpx upper bound already
satisfied), so no other locked package changes. Verified: `uv.lock`
parses, `mcp = 1.28.1`, no `mcp-1.26.0` refs remain.

## Testing
```text
python -c "import tomllib; ...; print(pkgs['mcp'])"  -> 1.28.1   (uv.lock valid TOML)
git diff --stat                                       -> pyproject.toml | 4 ; uv.lock | 6
grep -c mcp-1.26.0 uv.lock                            -> 0
```
mcp 1.28.1 ≥ every advisory's fixed-version, so all 3 alerts + pip-audit
clear.

## Real Behavior Proof
- Env: local; hashes fetched from
`https://pypi.org/pypi/mcp/1.28.1/json`.
- Steps: bumped the pyproject floor + the single mcp lock entry;
validated TOML + version + absence of old refs.
- Not tested: full `uv sync` (the lock is separately stale — see note).

## Note (deliberate scoping)
A full `uv lock` refresh churns ~900 lines: the lock is **separately
stale** (missing some declared deps) and local `uv` resolution diverges
(major downgrades of protobuf/posthog/portalocker — likely an env
artifact). That's a pre-existing lock-hygiene problem for its own PR —
**not** bundled into this security fix. No `CHANGELOG.md` edit
(release-please owns it).

pyproject.toml

@@ -73,7 +73,7 @@ proxy = [
     "orjson>=3.9.14; platform_python_implementation != 'PyPy'",
     "httpx[http2]>=0.24.0",
     "openai>=2.14.0",             # OpenAI API format support
-    "mcp>=1.0.0",                 # MCP server (headroom_compress, retrieve, stats)
+    "mcp>=1.28.1",                 # MCP server (headroom_compress, retrieve, stats)
     "magika>=0.6.0",              # ML content detection for ContentRouter
     "zstandard>=0.20.0",          # Decompress zstd request bodies (Codex, etc.)
     "websockets>=13.0",           # WebSocket proxy for /v1/responses (Codex gpt-5.4+)
@@ -220,7 +220,7 @@ autogen = [
 ]
 # MCP server for Claude Code integration
 mcp = [
-    "mcp>=1.0.0",
+    "mcp>=1.28.1",
     "httpx>=0.24.0",
     "starlette>=0.27.0",
     "uvicorn>=0.23.0,<1.0",

uv.lock

@@ -2626,7 +2626,7 @@ wheels = [
 
 [[package]]
 name = "mcp"
-version = "1.26.0"
+version = "1.28.1"
 source = { registry = "https://pypi.org/simple/" }
 dependencies = [
     { name = "anyio" },
@@ -2644,9 +2644,9 @@ dependencies = [
     { name = "typing-inspection" },
     { name = "uvicorn", marker = "sys_platform != 'emscripten'" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/fc/6d/62e76bbb8144d6ed86e202b5edd8a4cb631e7c8130f3f4893c3f90262b10/mcp-1.26.0.tar.gz", hash = "sha256:db6e2ef491eecc1a0d93711a76f28dec2e05999f93afd48795da1c1137142c66", size = 608005, upload-time = "2026-01-24T19:40:32.468Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/6e/77/9450b8f251a13affb6281997d0523c4615f8a8b35d0b21ff30db3a5aac9d/mcp-1.28.1.tar.gz", hash = "sha256:d51e36a5f5644faea4f85ea649bfffa6bc6c26770d42798ad6a3de3d2ba69683", size = 638501, upload-time = "2026-06-26T12:57:29.093358Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/fd/d9/eaa1f80170d2b7c5ba23f3b59f766f3a0bb41155fbc32a69adfa1adaaef9/mcp-1.26.0-py3-none-any.whl", hash = "sha256:904a21c33c25aa98ddbeb47273033c435e595bbacfdb177f4bd87f6dceebe1ca", size = 233615, upload-time = "2026-01-24T19:40:30.652Z" },
+    { url = "https://files.pythonhosted.org/packages/e2/5e/d118fce19f87a2e7d8101c35c8ae0ec289098a4df0ff244cec23e415aca0/mcp-1.28.1-py3-none-any.whl", hash = "sha256:2726bca5e7193f61c5dde8b12500a6de2d9acf6d1a1c0be9e8c2e706437991df", size = 222620, upload-time = "2026-06-26T12:57:27.218095Z" },
 ]
 
 [[package]]