Fix feature flag checker and add insiders mode support

[kerobbi]

Summary

Fixes feature flag checking for STDIO and HTTP modes, and adds insiders mode support for HTTP.

Why

Fixes #

What changed

• Uncommented WithFeatureChecker(featureChecker) in STDIO inventory builder
• Added X-MCP-Insiders and X-MCP-Features headers parsing in middleware
• Added new routes /insiders, /readonly/insiders, /x/{toolset}/insiders, and /x/{toolset}/readonly/insiders
• Added ctx helpers WithInsidersMode / IsInsidersMode and WithHeaderFeatures / GetHeaderFeatures
• Updated GetFlags to now read InsidersMode from ctx
• Removed unused Flags field from RequestDeps
• Fixed docs to use "append /insiders" pattern instead of prepend

MCP impact

• No tool or API changes
• Tool schema or behavior changed
• New tool added

Prompts tested (tool changes only)

Security / limits

• No security or limits impact
• Auth / permissions considered
• Data exposure, filtering, or token/size limits considered

Tool renaming

• I am renaming tools as part of this PR (e.g. a part of a consolidation effort)
  • I have added the new tool aliases in deprecated_tool_aliases.go
• I am not renaming tools as part of this PR

Note: if you're renaming tools, you must add the tool aliases. For more information on how to do so, please refer to the official docs.

Lint & tests

• Linted locally with ./script/lint
• Tested locally with ./script/test

Docs

• Not needed
• Updated (README / docs / examples)