Stop tracking .mcp.json; it carries a real API key

.mcp.json needs NOVELLY_API_KEY to match the API's Auth:ServiceApiKey
user secret, so it can't be a checked-in file — gitignore it and keep
.mcp.json.example (with the key blanked out) as the template. README
walks through copying the example and setting the matching user secret.

.gitignore

@@ -436,6 +436,7 @@ dist/
 *.db-shm
 *.db-wal
 mcp-server/
+.mcp.json
 
 # Toolchains installed locally by scripts/ci/lib.sh
 .dotnet/