refactor: replace mcp-go with the official MCP Go SDK (#223)

## Summary

Replace `github.com/mark3labs/mcp-go` with the official
`github.com/modelcontextprotocol/go-sdk v1.7.0`.

All 54 existing tools, scopes, CLI, `stdio` and HTTP (`/mcp`) modes, and
per-request authentication remain supported. This PR is limited to the SDK
equivalence migration; the stateless 2026 HTTP transport is deferred to a
follow-up PR.

## Verification

- Tool definitions were compared with `main` and matched for all 54 tools.
- `make lint`, `make fmt`, `go test -count=1 -race ./...`, `make build`, and
  `make tidy` pass.

---------

Co-authored-by: bircni <bircni@icloud.com>
Co-authored-by: silverwind <me@silverwind.io>
Reviewed-on: https://gitea.com/gitea/gitea-mcp/pulls/223
Reviewed-by: silverwind <2021+silverwind@noreply.gitea.com>
Reviewed-by: bircni <bircni@icloud.com>
Co-authored-by: Bo-Yi Wu <appleboy.tw@gmail.com>

pkg/annotation/annotation.go

@@ -1,18 +1,16 @@
 package annotation
 
-import "github.com/mark3labs/mcp-go/mcp"
+import "github.com/modelcontextprotocol/go-sdk/mcp"
 
-func ReadOnly(title string) mcp.ToolAnnotation {
+func ReadOnly(title string) *mcp.ToolAnnotations {
+	return &mcp.ToolAnnotations{Title: title, ReadOnlyHint: true}
+}
+
+func Write(title string) *mcp.ToolAnnotations {
+	return &mcp.ToolAnnotations{Title: title}
+}
+
+func Destructive(title string) *mcp.ToolAnnotations {
 	t := true
-	return mcp.ToolAnnotation{Title: title, ReadOnlyHint: &t}
-}
-
-func Write(title string) mcp.ToolAnnotation {
-	f := false
-	return mcp.ToolAnnotation{Title: title, ReadOnlyHint: &f}
-}
-
-func Destructive(title string) mcp.ToolAnnotation {
-	f, t := false, true
-	return mcp.ToolAnnotation{Title: title, ReadOnlyHint: &f, DestructiveHint: &t}
+	return &mcp.ToolAnnotations{Title: title, DestructiveHint: &t}
 }

pkg/annotation/annotation_test.go

@@ -0,0 +1,50 @@
+package annotation
+
+import (
+	"encoding/json"
+	"maps"
+	"testing"
+
+	"github.com/modelcontextprotocol/go-sdk/mcp"
+)
+
+// The hints are what clients use to decide whether a tool needs confirmation, so
+// assert the encoded form: an omitted readOnlyHint reads as false either way, but
+// only the explicit form survives a client that checks for the key.
+func TestAnnotations(t *testing.T) {
+	for _, test := range []struct {
+		name        string
+		annotations *mcp.ToolAnnotations
+		want        map[string]any
+	}{
+		{
+			name:        "ReadOnly",
+			annotations: ReadOnly("Read"),
+			want:        map[string]any{"title": "Read", "readOnlyHint": true, "idempotentHint": false},
+		},
+		{
+			name:        "Write",
+			annotations: Write("Write"),
+			want:        map[string]any{"title": "Write", "readOnlyHint": false, "idempotentHint": false},
+		},
+		{
+			name:        "Destructive",
+			annotations: Destructive("Delete"),
+			want:        map[string]any{"title": "Delete", "readOnlyHint": false, "idempotentHint": false, "destructiveHint": true},
+		},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			encoded, err := json.Marshal(test.annotations)
+			if err != nil {
+				t.Fatalf("json.Marshal() error = %v", err)
+			}
+			var got map[string]any
+			if err := json.Unmarshal(encoded, &got); err != nil {
+				t.Fatalf("json.Unmarshal() error = %v", err)
+			}
+			if !maps.Equal(got, test.want) {
+				t.Errorf("annotations = %s, want %v", encoded, test.want)
+			}
+		})
+	}
+}