Sweep remaining references to the old scripts/ directory that were
missed when scripts/ was renamed to bin/ in 1.3.6.
Fixes active config (ci.yml, .pre-commit-config.yaml, Justfile) and
documentation (CHECKLIST, INVENTORY, MARKETPLACE, SCRIPTS, REPO).
hooks/scripts/ and skills/unraid/scripts/ are intentional and unchanged.
Adds generate-cli recipe targeting local HTTP server for on-demand CLI
generation. Includes schema-hash caching, timeout 30, token-embedding
warning. Generated CLIs embed OAuth token — personal/local-only, never
commit or distribute.
TestMiddlewareOrdering (6 tests): stacked WellKnown→BearerAuth integration
tests that prove the ordering invariant for issue #17. Includes a negative
test that explicitly verifies the wrong order (BearerAuth outer) produces
401 on /.well-known/ — the exact regression scenario.
Justfile: add test-http, test-http-no-auth, test-http-remote targets.
test-http.sh: harden BASE_URL derivation to handle trailing slashes and
non-/mcp URL suffixes correctly.
Auth test suite now: 42 tests (was 26).
