Track: migrate to mcp python-sdk 2.x

Why

pyproject.toml intentionally caps mcp at <2 (see commit cbd8842, "Cap mcp dependency below breaking 2.x line") after dependabot PR #3 (bump 1.27.0 → 2.1.1) broke CI on all fronts:

• lint-and-test (3.11/3.12/3.13): tests/test_server_integration.py fails to collect — ImportError: cannot import name 'create_connected_server_and_client_session' from 'mcp.shared.memory'.
• Release checks: scripts/check_release.py hits the same missing import.
• Docker build: the smoke-test container exits before the health check ever succeeds (consistent with the same breaking-change family surfacing at server startup).

.github/dependabot.yml now has an ignore rule for mcp major-version bumps so this doesn't keep reopening weekly — this issue is the deliberate placeholder to come back to it.

What changed in mcp 2.x (per upstream release notes / migration guide)

• Architecture overhaul: session-centric design → dispatcher/runner pipeline. Low-level Server now takes handlers as constructor params with snake_case fields, not decorator registration.
• FastMCP renamed to MCPServer (decorator API stable, implementation moved).
• New unified Client replaces transport + ClientSession + initialize; this is why mcp.shared.memory.create_connected_server_and_client_session is gone.
• Protocol types split into a separate mcp-types package.
• Protocol bumped to the 2026-07-28 revision (stateless requests, no handshake) while still serving 2025-era clients (Claude Desktop, Cursor) from the same MCPServer.
• OAuth surface simplified — RFC7523OAuthClientProvider deprecated, Context.client_id removed. Directly relevant to raas_mcp/auth/vidb_auth.py and raas_mcp/auth/verifier.py, which import TokenVerifier/AccessToken from mcp.server.auth.middleware.bearer_auth.
• v1.x is now maintenance-only (security fixes on the v1.x branch).

Scope of the migration

Touches at least:

• raas_mcp/server.py, raas_mcp/server_http.py (Server construction, StreamableHTTPSessionManager)
• raas_mcp/auth/vidb_auth.py, raas_mcp/auth/verifier.py (bearer-auth middleware surface)
• tests/test_server_integration.py, scripts/check_release.py (new Client API instead of mcp.shared.memory)

Why do it (eventually)

No consumers depend on this server yet, so this is the cheapest point to absorb a breaking migration — it only gets more expensive once RaaS UI/clients are wired up. mcp 2.x's stateless protocol target also lines up with the VCF SSO statelessness/HPA design already written up in salt-sdd spec 010, so the migration may validate or simplify that design rather than fight it.

Suggested approach

Treat as a proper scoped task (design pass on the auth path, not a drive-by dependency bump):

1. Read the full upstream migration guide (docs/migration.md on the mcp python-sdk repo) end to end.
2. Rewrite server.py/server_http.py against the new Server constructor + dispatcher/runner model.
3. Re-validate vidb_auth.py/verifier.py against the simplified OAuth/bearer-auth surface.
4. Port tests/test_server_integration.py and scripts/check_release.py off mcp.shared.memory onto the new Client.
5. Bump mcp cap in pyproject.toml/requirements.txt, remove the dependabot ignore rule for mcp major bumps.

Related: PR #3 (closed, not merged).

Read the upstream mcp Python SDK migration guide first, then inspect raas_mcp/server.py and server_http.py for the Server and session-manager migration. Review raas_mcp/auth/vidb_auth.py and verifier.py for bearer-auth changes, and port tests/test_server_integration.py plus scripts/check_release.py to the new Client API. Done means CI and Docker checks pass, the dependency cap is updated, and the Dependabot major-version ignore is removed.