fix(auth): clear public write errors and Grok client path

Public DEC-654 still requires a caller bearer; anonymous session now
returns that guidance as a tool error instead of silent valid:false.
Error text names JWT and API key, Grok bearer_token_file, and local
stdio. BearerFromRequest also accepts X-Api-Key / X-Verae-Key.
Document Grok stdio vs public URL; add scripts/sync-mcp-bearer.sh.

README.md

@@ -54,6 +54,43 @@ Point MCP clients at `http://127.0.0.1:8001/mcp`. For stdio: `-transport stdio`
 
 Global stamps use VeraeTime with auth from `auth.properties` (or caller Bearer). Embedded NATS serves `verae.ts.*`; job-complete is core `verae.ts.completed` only.
 
+### Public HTTP vs local stdio (DEC-654)
+
+| Transport | Writes |
+| --- | --- |
+| Public HTTP (`mcp.verae.ai`, default streamable-http) | Caller must send `Authorization: Bearer <JWT or API key>` on every tools/call. No host-login fallback. |
+| Local stdio (`-transport stdio`) | Host login from `~/.verae/auth.properties` is used when no caller bearer is sent. |
+
+### Grok Build CLI
+
+**Option A — local stdio (recommended for laptop agents):** host auth, no public lockdown.
+
+```toml
+# ~/.grok/config.toml
+[mcp_servers.verae-timestamping]
+command = "/absolute/path/to/bin/verae-mcp-timestamping-server"
+args = ["-transport", "stdio"]
+enabled = true
+
+[mcp_servers.verae-timestamping.env]
+VERAE_NATS_LISTEN = ""
+```
+
+**Option B — public URL with caller bearer:**
+
+```sh
+./scripts/sync-mcp-bearer.sh   # writes ~/.verae/mcp-bearer from auth.properties
+```
+
+```toml
+[mcp_servers.verae-timestamping]
+url = "https://mcp.veraetime.net/mcp"
+enabled = true
+bearer_token_file = "~/.verae/mcp-bearer"
+```
+
+Reconnect the MCP server after config changes (new Grok session or `/mcps` toggle).
+
 Parity smoke when Python `:8000` and Go `:8001` are both up:
 
 ```sh