Function authenticate_mcp_transport 

pub(crate) async fn authenticate_mcp_transport(
    __arg0: State<Arc<KeyStore>>,
    req: Request,
    next: Next,
) -> Response

Scope-mode transport authentication boundary for every /mcp request.

This runs outside rmcp’s [StreamableHttpService], so a rejected request cannot create, inspect, stream, or close a session. Tool-level scope, account, and quota checks remain inside the MCP handlers.