chore(deps): fastmcp 4 (mcp 2.2)

No code change needed: the server side (`FastMCP`, `@mcp.tool`,
`get_http_headers`, `http_app`) and the client side (`Client`, `BearerAuth`,
the three transports, and the `mcp.client.auth` / `mcp.shared.auth` OAuth
types imported directly) all kept their signatures.

Verified beyond the suite by driving the real `/mcp` mount over a live
uvicorn socket with the fastmcp client: tool discovery, a `search_docs` call
and bearer-token extraction all round-trip, with the token reaching
`search()` intact.

fastmcp 4 and mcp 2.2 also moved to httpx2, so the retry tuple's comment now
places them on that side of the split.

pyproject.toml

@@ -55,7 +55,7 @@ dependencies = [
   # with no model downloads. The docling engine is the `docling` extra.
   "firecrawl-anydoc>=0.2.4,<0.3",
   "fastembed>=0.8.0,<0.9",
-  "fastmcp>=3.4.6,<4",
+  "fastmcp>=4.0.3,<5",
   "Flask>=3.1.3,<4",
   "flask-restx>=1.3.2,<2",
   "google-api-python-client>=2.198.0,<3",