feat(mcp): trigger lazy auth on JSON-RPC body errors

[lorem-dev]

Summary

Extend the lazy-auth retry path so it fires not only on HTTP 401/403,
but also when the remote MCP server returns a JSON-RPC body error or
a tool-result with isError: true. Until now, a server that always
answered HTTP 200 with a body-level error would never trigger the
auth-header resolver and the agent would loop forever without
credentials. This PR closes that gap.

What's in this branch

• internal/mcp/jsonrpc_error.go (+tests) - minimal JSON-RPC 2.0
  envelope parser with inspectResponse(raw []byte) bool that
  returns true for responses carrying a top-level error or
  result.isError, after sanity-checking jsonrpc == "2.0" and a
  non-null id. extractID(raw) returns the raw bytes of the id
  for use as a map key (so two responses share the same logical id
  iff their extractID outputs match).
• internal/mcp/auth_state.go (+tests) - shared authState that
  guarantees one-shot header resolution. The transport and the body
  inspector both route through this state so a single resolve
  covers both retry triggers.
• internal/mcp/proxy.go rewritten to track in-flight request ids
  and re-send the original request through the auth-resolved
  transport when inspectResponse flags the response as retry-worthy.
• HTTP and SSE transports updated to consult authState for the
  auth-retry path instead of inlining the resolver.
• Docs: docs/architecture.md describes the new body-level trigger.
• CHANGES.md bullet under ## Development.

Context: PR #3

A prior PR #3 from the same branch was merged into develop on
2026-05-15 (merge commit 6becdfc9), but develop was subsequently
rewritten and the merge commit + the seven feature commits are no
longer reachable from any released history. The branch was also
deleted from GitHub at PR-merge time. This PR resubmits the same
work against the current develop tip so the change actually lands.

Test plan

• make verify passes (all 7 gates).
• Existing proxy_retry_test.go covers: body-level error
  response triggers one-shot resolver, retried request gets
  the resolved headers, second response forwarded unchanged.
• jsonrpc_error_test.go covers: notifications, id:null,
  malformed JSON, valid responses with error and with
  result.isError, no-error happy path.
• Manual sanity: connect a stdio client to an MCP server
  that answers 200 + {"error":{...}} on first call,
  observe header resolution + retry.