usp-cms-mcp: MCP endpoint at /mcp (Authorization: Bearer <payload-mcp-api-key>)