feat(worker): add external MCP endpoint with API-key auth

A second WebApplication runs the external MCP server on its own port (default 47822) so it can expose a different tool set under different auth than the internal /mcp endpoint. Shared singletons (config, broadcaster, queue, db factory) are injected by instance so both apps share runtime state. ExternalMcpAuthMiddleware enforces an optional X-ClaudeDo-Key header; loopback-only trust when no key is configured.

Tools: ListTaskLists, ListTasks, GetTask, AddTask, UpdateTaskStatus, RunTaskNow, CancelTask.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/ClaudeDo.Worker/External/ExternalMcpAuthMiddleware.cs

@@ -0,0 +1,32 @@
+using ClaudeDo.Worker.Config;
+using Microsoft.AspNetCore.Http;
+
+namespace ClaudeDo.Worker.External;
+
+public sealed class ExternalMcpAuthMiddleware
+{
+    private const string HeaderName = "X-ClaudeDo-Key";
+
+    private readonly RequestDelegate _next;
+
+    public ExternalMcpAuthMiddleware(RequestDelegate next) => _next = next;
+
+    public async Task InvokeAsync(HttpContext ctx, WorkerConfig cfg)
+    {
+        if (string.IsNullOrEmpty(cfg.ExternalMcpApiKey))
+        {
+            await _next(ctx);
+            return;
+        }
+
+        var provided = ctx.Request.Headers[HeaderName].ToString();
+        if (!string.Equals(provided, cfg.ExternalMcpApiKey, StringComparison.Ordinal))
+        {
+            ctx.Response.StatusCode = 401;
+            await ctx.Response.WriteAsync($"Missing or invalid {HeaderName} header");
+            return;
+        }
+
+        await _next(ctx);
+    }
+}