Add Proc and Array support for auth_token

[kpheasey]

Summary

• Allow auth_token to accept a Proc (evaluated once at initialization) in addition to a static string, enabling dynamic token resolution from environment variables or secrets managers
• Allow auth_token to accept an Array of Strings, so multiple valid tokens can authenticate against the same server
• Add 15 RSpec tests covering Proc (single string, array, and nil return values) and Array token validation
• Update all documentation, YARD docstrings, examples, and generator templates to reflect the new accepted types

Motivation

In production deployments, it's common to need multiple valid API tokens (e.g., during token rotation, or when multiple clients each have their own token). It's also useful to resolve tokens dynamically from environment variables or a secrets manager rather than hardcoding them. This change enables both patterns with minimal API surface change.

Changes

• lib/mcp/transports/authenticated_rack_transport.rb — Resolve Proc at init, check Array via include?
• spec/mcp/transports/authenticated_rack_transport_spec.rb — 15 new tests (38 total, all passing)
• README.md, docs/security.md — Expanded authentication docs with examples
• lib/fast_mcp.rb — Updated YARD @option docstrings
• examples/authenticated_rack_middleware.rb — Added usage comments
• examples/rails-demo-app/config/initializers/fast_mcp.rb — Updated comment
• lib/generators/fast_mcp/install/templates/fast_mcp_initializer.rb — Updated generator template

Usage

# Static token (existing behavior, unchanged)
auth_token: 'your-secret-token'

# Multiple valid tokens
auth_token: ['token-one', 'token-two']

# Proc evaluated at initialization
auth_token: -> { ENV.fetch('MCP_AUTH_TOKENS').split(',') }

Test plan

• All 38 authenticated_rack_transport specs pass (23 existing + 15 new)
• Proc returning a single string resolves and authenticates correctly
• Proc returning an array resolves and validates any token in the array
• Proc returning nil disables authentication
• Array token accepts any valid token and rejects invalid ones
• Existing single-string token behavior is unchanged