P1a: Ensure ApiKeyMiddleware skips /mcp endpoint

The MCP endpoint handles its own authentication via X-Agent-Id and
X-Nexus-Api-Key headers through NexusMcpTools. The ApiKeyMiddleware
now skips the /mcp path to avoid interfering with MCP's own auth flow.

backend/Middleware/ApiKeyMiddleware.cs

@@ -6,11 +6,23 @@ namespace Nexus.Api.Middleware;
 /// Middleware that authenticates requests via the X-Nexus-Api-Key header.
 /// On match, sets a ClaimsPrincipal with role "Service".
 /// On mismatch or absent header, passes through to next middleware (JWT auth).
+///
+/// The MCP endpoint (/mcp) is intentionally skipped — the MCP SDK handles its own
+/// authentication via X-Agent-Id + X-Nexus-Api-Key headers through NexusMcpTools.
 /// </summary>
 public sealed class ApiKeyMiddleware(RequestDelegate next)
 {
+    private static readonly PathString McpPath = new("/mcp");
+
     public async Task InvokeAsync(HttpContext context)
     {
+        // MCP endpoint handles its own auth — skip ApiKey interference
+        if (context.Request.Path.StartsWithSegments(McpPath))
+        {
+            await next(context);
+            return;
+        }
+
         var configuration = context.RequestServices.GetRequiredService<IConfiguration>();
         var apiKey = configuration["NexusApiKey"];