feat(authz): manage-scope API keys may reach /api/mcp/* from non-loopback — integrated into release/v3.8.2