fix(security): require credentials on the MCP endpoints under AUTO_LOGIN (#14643)

* fix(security): require credentials on the MCP endpoints under AUTO_LOGIN

The MCP credential resolvers were the only authenticated entrypoints that did
not honour LANGFLOW_SKIP_AUTH_AUTO_LOGIN. With AUTO_LOGIN enabled and
skip_auth_auto_login left at its default of false, every other route rejects a
caller that presents no token and no API key, while the MCP resolvers resolved
that caller to the configured superuser and served the request.

Two resolvers were affected:

- AuthService.get_current_user_mcp (services/auth/service.py), which backs the
  CurrentActiveMCPUser dependency used by the global MCP router, the per-project
  MCP routes and the agentic MCP router.
- verify_project_auth / _superuser_fallback (api/v1/mcp_projects.py), reached by
  the per-project MCP transport endpoints when MCP Composer is enabled.

Both now apply the same guard the standard paths use: AUTO_LOGIN alone is not a
credential, so a credential-less caller is rejected with 403 AUTO_LOGIN_ERROR
unless skip_auth_auto_login is explicitly enabled. The opt-in fallback behaviour
is unchanged.

The MCP install handler now also provisions an API key whenever the superuser
fallback is unavailable, so generated client configs keep working in the default
configuration instead of being rejected at connect time.

Regression tests cover both resolvers in the rejecting and the opt-in
configurations, and the install handler's key provisioning.

Fixes LE-2239

* fix(security): honour a presented MCP API key under AUTO_LOGIN

With MCP Composer enabled and a project carrying no auth_settings,
requires_api_key evaluates False under AUTO_LOGIN, so the API-key branch was
skipped even when the caller presented a valid key. The caller then fell through
to the superuser fallback, which this PR makes reject, so a key minted by
POST /{id}/install could never authenticate.

Validate a key whenever one is presented. Callers presenting no credential still
reach _superuser_fallback and receive 403 AUTO_LOGIN_ERROR, preserving the
mitigation and its guard tests.

Also assert the generated key's value in the install test, which previously
checked only that the x-api-key header name appeared in the args list.