Aspire MCP server documentation: HTTP endpoint auth (x-mcp-api-key) is undocumented and launchSettings.json MCP endpoint URL is misleading

## Summary

The Aspire documentation for the MCP server at https://learn.microsoft.com/en-us/dotnet/aspire/fundamentals/ai-coding-agents/mcp-server mentions the HTTP-based MCP endpoint and `x-mcp-api-key` header but does not explain how to obtain or configure the API key. Additionally, the `launchSettings.json` generated by Aspire includes `ASPIRE_DASHBOARD_MCP_ENDPOINT_URL` which suggests the HTTP endpoint is the primary integration point, creating confusion about the correct MCP transport to use.

## Problem

### 1. `x-mcp-api-key` header is mentioned but never documented

The docs state:

> "For the HTTP-based MCP endpoint exposed by the Aspire dashboard (used in manual MCP configuration for older Aspire versions), an API key (`x-mcp-api-key` header) is required."

However, there is no documentation on:
- How to generate or retrieve this API key
- Where it is stored or configured
- Whether it is the same as the dashboard login token or a separate credential

This makes the HTTP MCP endpoint completely unusable through documented means.

### 2. `ASPIRE_DASHBOARD_MCP_ENDPOINT_URL` in launchSettings.json is misleading

When running `aspire run`, the generated `launchSettings.json` includes:

```json
"ASPIRE_DASHBOARD_MCP_ENDPOINT_URL": "https://localhost:23139"
```

This suggests that connecting to this endpoint via StreamableHTTP transport is the intended MCP integration method. An integrator naturally attempts to connect to this URL, only to receive HTTP 401 with no documented way to authenticate.

The actual correct approach (STDIO via `aspire agent mcp`) is documented separately, but the presence of the MCP endpoint URL in launchSettings.json actively misleads integrators away from it.

### 3. Steps to reproduce

1. Create an Aspire project with an AppHost
2. Run `aspire run` — note the `ASPIRE_DASHBOARD_MCP_ENDPOINT_URL` in launchSettings.json
3. Attempt to connect to the MCP endpoint via HTTP with:
- The dashboard login token as `Authorization: Bearer ` — returns 401
- The dashboard login token as `x-mcp-api-key: ` — returns 401
- The dashboard auth cookie (`.Aspire.Dashboard.Auth`) — returns 401
- Query string `?t=` — returns 401
4. Observe that no documented method authenticates against this endpoint

## Expected behavior

Either:

**Option A:** Document how to obtain and use the `x-mcp-api-key` so the HTTP endpoint can be used by non-STDIO MCP clients (StreamableHTTP-based integrations like Hermes Agent, n8n, etc.)

**Option B:** Clearly state in the documentation that the `ASPIRE_DASHBOARD_MCP_ENDPOINT_URL` is internal/private and not intended for direct MCP client connections, and that STDIO (`aspire agent mcp`) is the only supported transport. Additionally, consider removing or renaming this environment variable to avoid confusion.

## Environment

- Aspire: 13.2.2 (SDK 13.2.3)
- .NET: 10.0.203
- OS: Ubuntu 24.04

## Suggested documentation fix

In the "Authentication" section of the MCP server docs, replace the current one-liner about `x-mcp-api-key` with:

> The HTTP-based MCP endpoint (`ASPIRE_DASHBOARD_MCP_ENDPOINT_URL`) is an internal endpoint used by the Aspire CLI. It is not intended for direct MCP client connections. To integrate with the Aspire MCP server, use the STDIO transport via `aspire agent mcp`, which requires no authentication.

OR provide clear instructions on how to obtain the API key and configure HTTP-based MCP clients.

---

Related: The `launchSettings.json` schema at `https://json.schemastore.org/launchsettings.json` should also document the purpose of `ASPIRE_DASHBOARD_MCP_ENDPOINT_URL` to prevent integrators from interpreting it as a public MCP endpoint.