docs: drop the removed MCP query-token auth guidance

[buddies2705]

What

Fixes the broken anchor npm run build reports:

Broken anchor on source page path = /docs/mcp/build-a-trading-agent/:
 -> linking to /docs/mcp/mcp-server/#authentication-via-query-token-less-secure

Why not just re-anchor it

Commit 2bfb9b3 removed the "Authentication via query token (less secure)" section from docs/mcp/mcp-server.mdx as an incorrect auth method. The sentence holding the dangling link didn't just link to that section — it repeated its instruction:

For headless servers, append ?token=YOUR_TOKEN

Re-pointing the link would have left users following a method that was deliberately deleted. Both the link and the instruction are gone; the text now describes the OAuth 2.1 flow mcp-server.mdx actually documents, and links to the #first-connection-and-permissions section.

Confirmed with the docs owner: removing query-token auth from the docs is intended. OAuth 2.1 is the supported path. This PR finishes that removal rather than reviving it.

Second occurrence, not build-visible

docs/mcp/cursor.mdx:48 carried the same claim in an FAQ answer:

Can I use an API token instead of OAuth? → "Yes for headless setups — append ?token=YOUR_TOKEN to the MCP URL."

It has no link, so the build never flagged it, but it is the same instruction that was removed from the overview page. Fixed here so the method is gone from the MCP docs entirely rather than surviving in the one place the link checker can't see.

?token=YOUR_TOKEN elsewhere in the docs refers to streaming.bitquery.io WebSockets, which does support it — untouched. That's also the likely origin of the error: the deleted section explicitly reasoned by analogy from the WebSocket behaviour.

Side note for whoever runs the MCP server (not a docs issue)

The server's RFC 9728 metadata still advertises query-parameter bearer auth, which is now inconsistent with the documented position:

$ curl -s https://mcp.bitquery.io/.well-known/oauth-protected-resource
{"resource":"https://mcp.bitquery.io","authorization_servers":["https://account.bitquery.io"],
 "bearer_methods_supported":["header","query"], ...}

Flagging only so it isn't a surprise later — a client that reads this metadata may try query auth. Nothing in this PR depends on it, and it needs no action here.

Verification

npm run build passes; the broken-anchor warning is gone, and grepping the full log for broken|anchor returns nothing. Confirmed in the built HTML that id="first-connection-and-permissions" exists on the mcp-server page and that no token=YOUR_TOKEN survives under build/docs/mcp/.

🤖 Generated with Claude Code