Add Anthropic search-only MCP profile

[hmishra2250]

Summary

• Adds /v2/mcp-search as a separate, OAuth-only hosted MCP profile for Anthropic marketplace review.
• Exposes only the approved six tools:
  • firecrawl_search
  • firecrawl_research_search_papers
  • firecrawl_research_inspect_paper
  • firecrawl_research_related_papers
  • firecrawl_research_read_paper
  • firecrawl_research_search_github
• Gives the profile its own OAuth resource identity and protected-resource metadata path.
• Accepts only same-resource OAuth on /v2/mcp-search; rejects legacy/full-profile audiences and Firecrawl API-key headers.
• Removes scrapeOptions and enterprise from the advertised firecrawl_search schema and drops both defensively before upstream dispatch.
• Uses marketplace-specific, process-static instructions while byte-freezing the existing /v2/mcp and /v2/mcp-oauth instructions.
• Adds nginx routing plus hosted MCP contract coverage for profile metadata, auth posture, schema projection, live tool metadata hash, and budget ceilings.

Contract shape

/v2/mcp-search is a frozen marketplace profile, not a user-selectable tool subset:

• no ?tools= selectors
• OAuth-only
• separate audience/resource identity
• six read-only search/research tools only
• search/research upstreams only; no scrape/map/crawl/interact upstream calls

Current evidence for this PR head

Head: f75a44d5eaffe8464e210860844233f6e97a006f

Own-branch contract/test evidence:

• Hosted MCP contract version: 1.1.0
• Hosted MCP contract digest: 5cb665df...
• Anthropic /v2/mcp-search metadata digest: 228fad23...
• OpenAI /v2/mcp-oauth full metadata digest remains frozen: b8753aac...
• Own-branch test suite: 74/74 passed

Profile behavior covered by tests:

• /v2/mcp-search exposes exactly the six-tool profile without scrapeOptions.
• Every allowed profile tool calls only /v2/search or /v2/search/research/*.
• Non-profile tools reject without upstream execution.
• Legacy /v2/mcp OAuth audience is rejected by default.
• API-key headers are rejected because the profile is OAuth-only.
• Existing /v2/mcp and /v2/mcp-oauth metadata/instructions remain byte-frozen for their current contracts.

Mandatory retained-branch release rule

This Train 2 MCP-server draft intentionally targets the unmerged Train 1 parent branch feature/hosted-mcp-resend-parity-runtime from PR #308. After #308 merges, retarget this PR to main, rebase/update the branch, rerun required CI, and verify the PR diff contains only this child Train 2 delta. Do not merge this child PR while its base is the retained feature branch; doing so would update the feature branch rather than main and bypass the intended release boundary.

Draft only. Do not merge, deploy, or close from this PR directly. Himadri reviews before merge.

[hmishra2250]

Superseded by merged #332 (primary search profile) and #333 (profile-aware readiness). The remaining Stage 2 behavior is being validated through the new train.