Initial schulcloud-mcp server

Read-only MCP server exposing a Schulcloud account to Claude: courses,
column boards, lessons, tasks, and file downloads with text extraction.

The API surface was verified against the live instance rather than
inferred from upstream source, which changed several design decisions:

- The `jwt` cookie works verbatim as `Authorization: Bearer` and lasts 30
  days, so there is no cookie jar and no refresh-session timer.
- Course contents live at /api/v3/course-rooms/{courseId}/board; there is
  no GET /api/v3/courses/{id}.
- Files are a separate service (/api/v3/file/*) with its own OpenAPI doc.
- Board file elements carry no file id; attachments are resolved by
  listing files-storage with parentType=boardnodes and the element id.

Read-only by construction: every client method is a GET, including the
api_get escape hatch. The endpoint is internet-facing by necessity, so a
leaked token being unable to act as the user is the key safety property.

Deploys as a container behind the Pi's existing Caddy, guarded by a
constant-time bearer check. Stateless — no database.

Verified: 28 unit tests, plus a 30-check end-to-end run driving a real
MCP client over Streamable HTTP against the live account.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

src/bin/stdio.ts

@@ -0,0 +1,22 @@
+#!/usr/bin/env node
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import { loadConfig } from '../config.ts';
+import { createServer } from '../server.ts';
+
+/**
+ * stdio entry point — for running the server locally against Claude Code or
+ * Claude Desktop. The remote deployment uses bin/http.ts instead.
+ *
+ * Nothing may be written to stdout here except MCP protocol frames.
+ */
+async function main(): Promise<void> {
+	const config = loadConfig();
+	const { server } = createServer(config);
+	await server.connect(new StdioServerTransport());
+	console.error(`[schulcloud-mcp] stdio transport ready for ${config.baseUrl}`);
+}
+
+main().catch((error: unknown) => {
+	console.error('[schulcloud-mcp] fatal:', error);
+	process.exit(1);
+});