Add Hy3 API Guardian MCP server

[Kanghz87]

What changed

This PR adds mcp_servers/api_guardian, a Python MCP server that packages Hy3 as an OpenAPI governance assistant with three read-only tools:

• audit_openapi: deterministic security/design checks plus grounded Hy3 analysis.
• detect_breaking_changes: deterministic OpenAPI compatibility diff plus a Hy3 migration plan.
• generate_contract_tests: Hy3-generated pytest or Jest contract tests for selected operations.

The package runs over local stdio, installs with pip install . (or runs with uvx --from . hy3-api-guardian), and includes project-level configuration examples for CodeBuddy and Cursor.

Why

Issue #3 asks for a reusable Hy3-powered MCP server with at least three tools, environment-based credentials, one-click installation, two-client verification, and a recorded demo. API contract governance is a distinct scenario from the existing general chat, code-review, knowledge-base, and research submissions, while still exercising Hy3 for core reasoning.

Safety and developer impact

• API keys are environment-only and excluded from Git.
• File reads are contained under HY3_ALLOWED_ROOT after real-path resolution.
• JSON/YAML size, nesting, node count, local-reference depth, and model context are bounded.
• YAML aliases are rejected; bounded local JSON Pointer $ref values are resolved where needed, while remote references are never fetched.
• Credential-like values are redacted before provider calls.
• OpenAPI content is delimited as untrusted prompt data.
• Public provider endpoints must use HTTPS; plaintext is restricted to exact loopback hosts.
• All tools declare read-only, non-destructive MCP annotations.
• Chinese and English READMEs include install, configuration, client, tool, safety, and troubleshooting guidance.
• The deterministic comparator intentionally covers common compatibility changes rather than claiming a complete formal proof.

Validation

• python -m ruff check .
• python -m ruff format --check .
• python -m pytest tests -p no:cacheprovider — 37 passed
• Built both wheel and source distribution successfully.
• Installed the final built wheel in a fresh virtual environment; pip check reported no broken requirements.
• Started the final wheel over stdio: MCP initialization succeeded, exactly three tools were listed, and all carried read-only annotations.
• Called all three tools through a real MCP stdio ClientSession and TokenHub Hy3; all provider requests returned HTTP 200.
• Parsed the real Hy3-generated pytest source with Python AST successfully.
• Re-verified a real audit_openapi call in CodeBuddy CLI 2.125.0.
• Verified native MCP tool discovery and a real detect_breaking_changes call in Cursor 3.12.17.
• Added sanitized verification records and an 18.9-second Cursor demo GIF.
• Confirmed no tracked file contains the locally configured real TokenHub key.

Related to #3.