Fix security vulnerabilities, package-lock.json, misc other changes

- Add rate limiting to prevent DoS attacks on vulnerable routes
- Update package-lock.json to use public npm registry
- Document intentionally permissive CORS for public test server
- Remove health endpoints to match original codebase (no health checks)
- Fix auth server splash page to list all OAuth endpoints
- Update test scripts to check server availability via splash page

scripts/test-e2e-external.sh

@@ -44,8 +44,8 @@ AUTH_MODE=auth_server PORT=3001 BASE_URI=$AUTH_SERVER node dist/index.js &
 AUTH_PID=$!
 sleep 5
 
-# Check auth server
-if ! curl -s -f "$AUTH_SERVER/health" > /dev/null; then
+# Check auth server by accessing splash page
+if ! curl -s -f "$AUTH_SERVER/" > /dev/null 2>&1; then
     echo "❌ Auth server failed to start at $AUTH_SERVER"
     kill $AUTH_PID 2>/dev/null || true
     exit 1
@@ -58,8 +58,8 @@ AUTH_MODE=external AUTH_SERVER_URL=$AUTH_SERVER PORT=8080 BASE_URI=$MCP_SERVER n
 MCP_PID=$!
 sleep 5
 
-# Check MCP server
-if ! curl -s -f "$MCP_SERVER/health" > /dev/null; then
+# Check MCP server by accessing splash page
+if ! curl -s -f "$MCP_SERVER/" > /dev/null 2>&1; then
     echo "❌ MCP server failed to start at $MCP_SERVER"
     kill $AUTH_PID 2>/dev/null || true
     kill $MCP_PID 2>/dev/null || true

scripts/test-e2e-internal.sh

@@ -41,8 +41,8 @@ AUTH_MODE=internal PORT=8080 BASE_URI=$SERVER_URL node dist/index.js &
 SERVER_PID=$!
 sleep 5
 
-# Check server health
-if ! curl -s -f "$SERVER_URL/health" > /dev/null; then
+# Check server is running by accessing splash page
+if ! curl -s -f "$SERVER_URL/" > /dev/null 2>&1; then
     echo "❌ Server failed to start at $SERVER_URL"
     kill $SERVER_PID 2>/dev/null || true
     exit 1