feat(mcp): support mcp 2.x #124

cyclops caps mcp<2 (#122). mcp 1.x is now in maintenance mode with security fixes only, so 2.x support is needed. From the v2.0.0 release notes and docs/migration.md, the changes that touch cyclops:

1. McpError is renamed MCPError (mcp/connection.py).
2. httpx and httpx-sse are replaced by httpx2: create_mcp_http_client, the http_client for streamable_http_client and sse_client's auth= take httpx2 types. cyclops builds an httpx.Timeout and types auth as httpx.Auth.
3. Protocol type fields are snake_case (is_error, input_schema, structured_content, mime_type, next_cursor); types move to the mcp-types package with mcp.types kept as an alias.
4. ClientSession.list_tools(cursor=...) is removed; pagination uses params=PaginatedRequestParams(cursor=...).
5. Timeouts take float seconds, not timedelta (call_tool(read_timeout_seconds=...)).
6. The lowlevel Server drops the list_tools/call_tool decorators for keyword-only on_* handlers; a tool handler exception becomes a JSON-RPC error instead of CallToolResult(is_error=True), so cyclops must build the error result itself to keep the model seeing the error text.
7. streamable_http_client returns a 2-tuple; the streamablehttp_client alias is removed.
8. ClientSession runs on JSONRPCDispatcher: notification callbacks run concurrently, cancelling a request sends notifications/cancelled, and a request timeout raises -32001.
9. FastMCP is renamed MCPServer (tests/fixtures/mcp_demo_server.py).
10. New: a single Client class, the 2026-07-28 protocol revision, and OpenTelemetry tracing on by default.

Related: cyclops imports httpx, anyio and pydantic_core directly without declaring them; they arrive through mcp and litellm, and mcp 2.x no longer brings httpx.

Proposal Declare the direct imports as dependencies, then support mcp 2.x (dropping 1.x or supporting both, decided by how much of the above a compatibility layer would need), with the test suite run against both until 1.x is dropped.