Harden server; add authenticated Streamable HTTP transport and Nix module

- Streamable HTTP transport (MCP_TRANSPORT=http) with mandatory auth:
  static bearer tokens or OIDC resource-server mode (JWT via JWKS, or
  RFC 7662 introspection), RFC 9728 protected-resource metadata, and
  DNS-rebinding protection
- secrets loadable from files via *_FILE variants
- timeouts on all outbound requests; JORTT_READ_ONLY tool filtering
- OpenAPI spec committed and bundled; no implicit network fetches
- Nix flake: sandboxed package build + hardened NixOS module taking an
  EnvironmentFile (agenix-friendly)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

nix/package.nix

@@ -0,0 +1,31 @@
+{ lib, buildNpmPackage, nodejs_22 }:
+
+buildNpmPackage {
+  pname = "jortt-mcp";
+  version = "0.2.0";
+
+  # Explicit fileset: never pull .env, dist/ or other stray files into the store.
+  src = lib.fileset.toSource {
+    root = ../.;
+    fileset = lib.fileset.unions [
+      ../package.json
+      ../package-lock.json
+      ../tsconfig.json
+      ../src
+      ../scripts
+      ../LICENSE
+      ../README.md
+    ];
+  };
+
+  nodejs = nodejs_22;
+
+  npmDepsHash = "sha256-eKdcd++SsI9gi3exUoNogbCpsUxSrVGRM1iQMUcF9Y4=";
+
+  meta = {
+    description = "Model Context Protocol server for the Jortt accounting API";
+    homepage = "https://github.com/deprekated/jortt-mcp";
+    license = lib.licenses.mit;
+    mainProgram = "jortt-mcp";
+  };
+}