feat(fred): plugin scaffold, API client, guided errors, CI

[walkerhughes]

Closes #31. First PR of the fred plugin stack (#30).

No tools yet, on purpose. This is the base the four later PRs sit on, plus the CI that gates them.

What's here

src/client.py resolves FRED_API_KEY from the environment, then ~/.fred-mcp/credentials.json. It checks the key's shape locally, because FRED's own message for a bad key is "The value for variable api_key is not a 32 character alpha-numeric lower-case string", which does not tell you that you pasted it with a trailing quote. The key is never echoed in anything raised from there. 429 and 5xx back off; 400 does not, since it is the caller's problem.

src/errors.py turns every failure into {error, suggestions}. The FRED-specific part: the real reason lives in the response body, not the status. A missing series and a bad units code are both HTTP 400 and only error_message tells them apart, so the suggestions key off the body:

{
  "error": "FRED rejected the request: Bad Request. The series does not exist.",
  "suggestions": [
    "The series ID is wrong or the series has been discontinued.",
    "Find the right one with search_series, which returns IDs ordered by popularity.",
    "IDs are case-sensitive and uppercase, e.g. UNRATE, CPIAUCSL, GDPC1, DFF."
  ],
  "status_code": 400
}

src/server.py reads its version from plugin.json instead of hardcoding it, so it cannot drift from the manifest the plugin version workflow requires be bumped.

Two deliberate differences from tastytrade

• mcp 2.0, where FastMCP is renamed MCPServer. The decorator API is otherwise identical. tastytrade is on 1.26; new plugin, so no reason to start on the old name.
• tool.uv.package = false instead of a build backend. tastytrade ships a tastytrade-mcp console script that has never worked (the src flattening breaks its relative imports), and start-server.sh works around it by running the module directly. Skipping the packaging metadata entirely removes the trap rather than documenting it.

Verification

make check and make coverage pass, 38 tests, 96% coverage. The launcher was driven end to end with a minimal PATH: initialize and tools/list over stdio, empty tool list, and stdout clean (a single stray print there corrupts the protocol and surfaces to the user as a parse error).

The test suite forces a dummy FRED_API_KEY and repoints the credentials-file fallback at a tmp dir, so nothing here can reach the real API or pick up a developer's own key.