Update MCP tool descriptions to point agents at example_recipes before saving Cooked recipe markdown, make URL import draft behaviour explicit, and remove stale shopping-list read-output normalization wording.

Remove the configuration-time requirement for MCP HTTP bearer authentication on non-loopback listen addresses. This lets users bind Streamable HTTP to Tailscale, LAN, all-interface, or hostname-like addresses without also configuring a token.

Keep bearer-token authentication available when configured, and cover the relaxed address handling with server.SECURITY.1-1 tests.