Static-header MCP server support in management UI

## Goal
Users can add static API keys or bearer tokens for MCP servers that use header-based auth.

## Acceptance criteria
- The MCP server edit form includes a key/value header editor (e.g., `Authorization: Bearer `, `x-api-key: `)
- Headers are stored in `McpServer.headers` (DynamoDB) — never logged or exposed to the browser beyond the owner's own UI
- At invocation time, headers are included in the `remote_mcp` tool spec passed to the harness
- Removing a header removes it from DynamoDB

## Files to modify
- `web/app/(with-auth)/agents/page.tsx` — add header key/value editor to MCP server form
- `web/lib/agentcore-transport.ts` — verify `McpServer.headers` is already forwarded in `remote_mcp` (it is — this is a UI-completeness issue)

## Dependencies
- Issue #148 (MCP CRUD UI)

## Notes
Verify Amplify/DynamoDB encryption at rest covers `McpServer.headers` — no additional application-layer encryption should be needed for API keys stored owner-only.

---
*Imported from `waltmayf/agentcore-amplify-fullstack`#36 — originally filed by @waltmayf on 2026-07-02. Migrated to open-source repo; cross-references updated post-import.*

Start in web/app/(with-auth)/agents/page.tsx by reading the existing MCP server edit form, then inspect web/lib/agentcore-transport.ts to confirm headers are forwarded in the remote_mcp tool spec. Check the existing MCP persistence model and encryption configuration before implementing the editor. Done means headers can be added and removed, persist in McpServer.headers, remain owner-only, and are included at invocation.

Written by the indexing model from the issue text.