feat(mcp): pull bearer token from environment variables

packages/mcp/hono.ts

···
 import { Hono } from "hono";
 import { cors } from "hono/cors";
+import { bearerAuth } from "hono/bearer-auth";
 import { createConsumer } from "@cistern/consumer";
 import { getLogger, withContext } from "@logtape/logtape";
 import { toFetchResponse, toReqRes } from "fetch-to-node";
···
   const logger = getLogger(["cistern", "http"]);
   const sessions = new Map<string, StreamableHTTPServerTransport>();
 
+  const token = Deno.env.get("CISTERN_MCP_BEARER_TOKEN");
+
+  if (!token) {
+    logger.error("http mode requires CISTERN_MCP_BEARER_TOKEN to be set");
+    return Deno.exit(1);
+  }
+
+  app.use("*", bearerAuth({ token }));
   app.use("*", async (c, next) => {
     const requestId = crypto.randomUUID();
     const startTime = Date.now();