fix(http): fail closed without auth config

[Daniyal0100101]

Describe your changes

Make Streamable HTTP transport fail closed when FastApiMCP is mounted without an AuthConfig.

Previously, mount_http() registered the MCP route without dependencies when auth_config was absent, allowing anonymous clients to initialize sessions and invoke exposed tools. This change installs a default FastAPI dependency that rejects HTTP MCP requests with 401 Unauthorized and a WWW-Authenticate: Bearer header before the MCP transport handles the request.

Configured AuthConfig.dependencies remain unchanged. The existing HTTP transport tests now provide an explicit no-op dependency so they continue testing the protocol behavior independently of authentication, and new regression coverage verifies the default route dependency and unauthenticated response.

Issue ticket number and link (if applicable)

Fixes #324

#324

Screenshots of the feature / bugfix

Not applicable. This is an HTTP authentication behavior change covered by regression tests.

Checklist before requesting a review

• Added relevant tests
• Run ruff & mypy
• All tests pass

Validation:

• uv run ruff check fastapi_mcp/server.py tests/test_http_real_transport.py
• uv run ruff format --check fastapi_mcp/server.py tests/test_http_real_transport.py
• uv run mypy fastapi_mcp/server.py tests/test_http_real_transport.py
• uv run pytest -q — 120 passed, 85.83% coverage
• uv run pre-commit run --files fastapi_mcp/server.py tests/test_http_real_transport.py

[K4bain]

@Daniyal0100101 — I adopted your patch from this PR and opened #334 with it (rebased onto current main, with two regression tests that fail on main today: unauthenticated requests really do get through the HTTP transport without any auth config). Full suite green. You are credited in the commit message and PR description — great catch, hopefully this helps it land.

[Daniyal0100101]

Thanks for carrying this forward and adding the regression coverage. Appreciate the credit as well. #334 looks good to me — happy for it to supersede #325 if that helps get the fix merged.