Add publish-mcp.sh so the standalone MCP binary stops going stale

Aspire doesn't run or manage src/Novelly.Mcp — it's a separate stdio
process the MCP client spawns from a published binary that nothing
rebuilds automatically. It had drifted 12 days out of date and was
silently missing the service-API-key auth header, causing confusing
401s. Script wraps the existing dotnet publish command via the shared
ensure_dotnet helper; README points at it instead of the raw command.

Also registers a UserSecretsId on Novelly.Api so Auth:ServiceApiKey
can be set locally without landing in appsettings.

scripts/publish-mcp.sh

@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+# Rebuilds the standalone Novelly.Mcp binary that Claude Code (or Claude Desktop) spawns
+# per .mcp.json. Aspire does not run or manage this process, so nothing else rebuilds it —
+# run this after pulling changes that touch src/Novelly.Mcp, or the MCP server silently
+# keeps serving whatever was published last.
+set -euo pipefail
+cd "$(dirname "${BASH_SOURCE[0]}")/.." && source ./scripts/ci/lib.sh
+cd "$CI_ROOT"
+
+ensure_dotnet
+
+log "Publishing Novelly.Mcp to ./mcp-server"
+dotnet publish src/Novelly.Mcp -c Release -o ./mcp-server
+
+log "Done. Reconnect the MCP server (e.g. /mcp in Claude Code) to pick up the new build."