Implementing anonymous MCP access requires per-tool buckets plus discovery-doc alignment

A TypeScript MCP-backed product needed to reduce onboarding friction by allowing no-auth read-only MCP calls while preserving auth gates for writes and expensive traversal. The same change also required install pages and machine-readable manifests to stop advertising auth-first snippets as the minimal path.