Add publish-mcp.sh so the standalone MCP binary stops going stale

Aspire doesn't run or manage src/Novelly.Mcp — it's a separate stdio
process the MCP client spawns from a published binary that nothing
rebuilds automatically. It had drifted 12 days out of date and was
silently missing the service-API-key auth header, causing confusing
401s. Script wraps the existing dotnet publish command via the shared
ensure_dotnet helper; README points at it instead of the raw command.

Also registers a UserSecretsId on Novelly.Api so Auth:ServiceApiKey
can be set locally without landing in appsettings.

README.md

@@ -185,9 +185,14 @@ its own — it is a second front end, not a second implementation.
 Build it, then point your MCP client at the produced binary:
 
 ```bash
-dotnet publish src/Novelly.Mcp -c Release -o ./mcp-server
+./scripts/publish-mcp.sh
 ```
 
+Aspire does not run or manage this process — it's a separate stdio subprocess your MCP
+client spawns directly, so nothing rebuilds it automatically. Re-run the script (and
+reconnect your MCP client) after pulling changes that touch `src/Novelly.Mcp`, or it keeps
+serving whatever was published last, including against a stale auth contract.
+
 `.mcp.json` (or Claude Desktop's config):
 
 ```jsonc