fix: reject conflicting auth sources instead of silent override

[xyaz1313]

Problem

When both an Authorization header and a ?token= query parameter are provided, TokenQuerystringMiddleware silently discards the header and uses the query token. This hides client misconfiguration and makes auth debugging harder.

Root Cause

In src/openapi_mcp_sdk/main.py lines 163-170, the middleware unconditionally strips the existing Authorization header when ?token= is present:

headers = [(k, v) for k, v in scope["headers"] if k.lower() != b"authorization"]

Fix

Reject conflicting auth sources with a 400 response instead of silently overriding:

• ?token= alone → works as before (lifted to header)
• Authorization header alone → works as before (existing JIT flow)
• Both present → 400 with clear error message

{
  "error": "conflicting_auth",
  "message": "Both Authorization header and ?token= query parameter are provided. Use only one authentication method."
}

This is a realistic integration mistake with browser-hosted clients, local proxies, and copied config snippets. A hard fail surfaces the problem immediately.

Fixes #27