[benoitc]

Replaces #77. hornbeam now serves one /mcp endpoint, so the per-endpoint tool_filter gives way to a per-caller decision by the auth provider.

• Optional barrel_mcp_auth callback visible/4, dispatched by barrel_mcp_auth:visible/4. The four list responses filter through it before pagination. Calls and reads are unchanged: hiding is not an access check. A raise or non-boolean hides the entry.
• barrel_mcp_auth_custom forwards visible/4 to its module when exported.
• The protocol ctx carries auth_config (barrel_mcp_ctx:auth_config/1) on every HTTP path, including the simple transport, which now also passes the caller's auth_info. Its modern tasks and requestState are therefore owned by the caller's principal instead of anonymous.
• barrel_mcp_client:call_tool/4 accepts meta, sent as params._meta (kept from Release 4.1.0: per-endpoint tool filter, _meta on call_tool #77).
• Without visible/4, every caller lists everything, as on 4.0.x.