fix(http): fail closed without auth config

[Daniyal0100101]

Describe your changes

Make Streamable HTTP transport fail closed when FastApiMCP is mounted without an AuthConfig.

Previously, mount_http() registered the MCP route without dependencies when auth_config was absent, allowing anonymous clients to initialize sessions and invoke exposed tools. This change installs a default FastAPI dependency that rejects HTTP MCP requests with 401 Unauthorized and a WWW-Authenticate: Bearer header before the MCP transport handles the request.

Configured AuthConfig.dependencies remain unchanged. The existing HTTP transport tests now provide an explicit no-op dependency so they continue testing the protocol behavior independently of authentication, and new regression coverage verifies the default route dependency and unauthenticated response.

Issue ticket number and link (if applicable)

Fixes #324

#324

Screenshots of the feature / bugfix

Not applicable. This is an HTTP authentication behavior change covered by regression tests.

Checklist before requesting a review

• Added relevant tests
• Run ruff & mypy
• All tests pass

Validation:

• uv run ruff check fastapi_mcp/server.py tests/test_http_real_transport.py
• uv run ruff format --check fastapi_mcp/server.py tests/test_http_real_transport.py
• uv run mypy fastapi_mcp/server.py tests/test_http_real_transport.py
• uv run pytest -q — 120 passed, 85.83% coverage
• uv run pre-commit run --files fastapi_mcp/server.py tests/test_http_real_transport.py