fix(mcp): exempt get_health from bearer token auth requirement

Health probes (Pallas health pollers, agent startup checks) call get_health
without a bearer token. Auth should only be required for data-access tools.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

mnemosyne/mcp_server/auth.py

@@ -200,8 +200,16 @@ class MCPAuthMiddleware(Middleware):
     MCP_REQUIRE_AUTH=False.
     """
 
+    # Tools that don't touch user data and must be callable without a token
+    # (e.g. Pallas health pollers, agent startup probes).
+    _PUBLIC_TOOLS = {"get_health"}
+
     async def on_call_tool(self, context: MiddlewareContext, call_next):
         require_auth = getattr(settings, "MCP_REQUIRE_AUTH", True)
+
+        if require_auth and self._extract_tool_name(context) in self._PUBLIC_TOOLS:
+            return await call_next(context)
+
         token_string = self._extract_token()
 
         user = None