Harden server; add authenticated Streamable HTTP transport and Nix module

- Streamable HTTP transport (MCP_TRANSPORT=http) with mandatory auth:
  static bearer tokens or OIDC resource-server mode (JWT via JWKS, or
  RFC 7662 introspection), RFC 9728 protected-resource metadata, and
  DNS-rebinding protection
- secrets loadable from files via *_FILE variants
- timeouts on all outbound requests; JORTT_READ_ONLY tool filtering
- OpenAPI spec committed and bundled; no implicit network fetches
- Nix flake: sandboxed package build + hardened NixOS module taking an
  EnvironmentFile (agenix-friendly)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

flake.nix

@@ -0,0 +1,35 @@
+{
+  description = "MCP server for the Jortt accounting & invoicing API";
+
+  inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+
+  outputs = { self, nixpkgs }:
+    let
+      systems = [ "x86_64-linux" "aarch64-linux" "x86_64-darwin" "aarch64-darwin" ];
+      forAllSystems = f: nixpkgs.lib.genAttrs systems (system: f nixpkgs.legacyPackages.${system});
+      mkPackage = pkgs: pkgs.callPackage ./nix/package.nix { };
+    in
+    {
+      packages = forAllSystems (pkgs: rec {
+        jortt-mcp = mkPackage pkgs;
+        default = jortt-mcp;
+      });
+
+      overlays.default = final: prev: {
+        jortt-mcp = mkPackage final;
+      };
+
+      nixosModules.jortt-mcp = { pkgs, lib, ... }: {
+        imports = [ ./nix/module.nix ];
+        services.jortt-mcp.package =
+          lib.mkDefault self.packages.${pkgs.stdenv.hostPlatform.system}.jortt-mcp;
+      };
+      nixosModules.default = self.nixosModules.jortt-mcp;
+
+      devShells = forAllSystems (pkgs: {
+        default = pkgs.mkShell {
+          packages = [ pkgs.nodejs_22 pkgs.typescript ];
+        };
+      });
+    };
+}