Stop tracking .mcp.json; it carries a real API key

.mcp.json needs NOVELLY_API_KEY to match the API's Auth:ServiceApiKey
user secret, so it can't be a checked-in file — gitignore it and keep
.mcp.json.example (with the key blanked out) as the template. README
walks through copying the example and setting the matching user secret.

.gitignore

@@ -436,6 +436,7 @@ dist/
 *.db-shm
 *.db-wal
 mcp-server/
+.mcp.json
 
 # Toolchains installed locally by scripts/ci/lib.sh
 .dotnet/

.mcp.json

@@ -1,11 +0,0 @@
-{
-  "mcpServers": {
-    "novelly": {
-      "command": "/home/james/src/novelly/mcp-server/Novelly.Mcp",
-      "env": {
-        "NOVELLY_API_URL": "http://localhost:5080",
-        "DOTNET_ROOT": "/home/james/.dotnet"
-      }
-    }
-  }
-}

.mcp.json.example

@@ -3,7 +3,8 @@
     "novelly": {
       "command": "./mcp-server/Novelly.Mcp",
       "env": {
-        "NOVELLY_API_URL": "http://localhost:5080"
+        "NOVELLY_API_URL": "http://localhost:5080",
+        "NOVELLY_API_KEY": "<matches the API's Auth:ServiceApiKey user secret>"
       }
     }
   }

README.md

@@ -193,21 +193,27 @@ client spawns directly, so nothing rebuilds it automatically. Re-run the script
 reconnect your MCP client) after pulling changes that touch `src/Novelly.Mcp`, or it keeps
 serving whatever was published last, including against a stale auth contract.
 
-`.mcp.json` (or Claude Desktop's config):
+Copy `.mcp.json.example` to `.mcp.json` (gitignored, since it carries your API key) and
+fill in the key:
 
 ```jsonc
 {
   "mcpServers": {
     "novelly": {
       "command": "/absolute/path/to/mcp-server/Novelly.Mcp",
-      "env": { "NOVELLY_API_URL": "http://localhost:5080" }
+      "env": {
+        "NOVELLY_API_URL": "http://localhost:5080",
+        "NOVELLY_API_KEY": "<matches the API's Auth:ServiceApiKey user secret>"
+      }
     }
   }
 }
 ```
 
-The API must be running. If it is not, the tools say so in a message the model can act on
+The API must be running, with `Auth:ServiceApiKey` set (e.g. via
-rather than failing opaquely.
+`dotnet user-secrets set Auth:ServiceApiKey <key> -p src/Novelly.Api`) to the same value
+as `NOVELLY_API_KEY` above. If the API is not running, or the key is missing or mismatched,
+the tools say so in a message the model can act on rather than failing opaquely.
 
 ### Importing an existing outline