fix: MCP endpoint at /api/mcp (Bug #2) + REST API key auth (Bug #3)

Bug #2 (LOW): MCP endpoint was mounted at /mcp instead of /api/mcp,
inconsistent with all other API routes. Changed app.route("/mcp", ...)
to app.route("/api/mcp", ...) in apps/api/src/index.ts.

Bug #3 (MEDIUM): REST API endpoints only accepted JWT cookie/session
auth, not API key auth. Added authenticateApiKey() to authMiddleware
in apps/api/src/middleware/auth.ts so REST endpoints now accept
Authorization: Bearer <api_key> as a fallback after JWT verification.

apps/web/src/routes/_app/calendar.tsx

@@ -266,6 +266,7 @@ function CalendarPage() {
           events={calendarEvents}
           startAccessor="start"
           endAccessor="end"
+          date={date}
           view={view}
           defaultView={Views.MONTH}
           onNavigate={handleNavigate}