feat(mcp): advertise the hosted /mcp endpoint via server.json remotes

The Timebook backend already ships a Streamable-HTTP MCP server at https://usetimebook.com/mcp with full OAuth 2.0 (DCR + PKCE + refresh-rotation, see commits 8619225 and 43a8bc5 in squidcode/timebook). Until now the MCP Registry only advertised the npm/stdio package — Claude.ai's "browse connectors" UI couldn't discover the hosted option.

Adds:
- server.json `remotes`: streamable-http transport pointing at https://usetimebook.com/mcp. Validated against the canonical 2025-12-11 server.schema.json.
- README: new "Use it as a remote MCP (Claude.ai web)" section explaining the OAuth flow, the well-known endpoints, and the dual-auth (OAuth or Bearer tbk_*) modes.

Net effect: claude.ai users can now connect Timebook directly with a click-to-authorize OAuth flow, no npm install required. Stdio install via npx still works exactly as before for desktop / CLI agents.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: ktamas77

README.md

@@ -96,6 +96,17 @@ Or, if installed globally:
 
 The MCP server reuses the token saved by `timebook login` — run `timebook login` once in a terminal before starting the agent.
 
+### Use it as a remote MCP (Claude.ai web)
+
+Timebook also runs as a hosted Streamable-HTTP MCP server at **`https://usetimebook.com/mcp`** with full OAuth 2.0 (Dynamic Client Registration + PKCE + refresh-token rotation). No CLI install required — Claude.ai discovers it via the standard well-known endpoints:
+
+- Auth-server metadata: `https://usetimebook.com/.well-known/oauth-authorization-server`
+- Resource metadata: `https://usetimebook.com/.well-known/oauth-protected-resource/mcp`
+
+Connect from Claude.ai → Settings → Connectors → Add → paste `https://usetimebook.com/mcp`. You'll be redirected to Timebook's consent page once, then Claude can use all the same tools listed below. Same OAuth-style permissions you'd see for any first-class connector.
+
+The HTTP endpoint also accepts `Authorization: Bearer tbk_*` (your existing API token) for any client that prefers token-paste over OAuth — including server-to-server use.
+
 ### Tools exposed to the model
 
 | Tool               | What it does                                                                                                              |

server.json

@@ -16,6 +16,12 @@
       "sizes": ["any"]
     }
   ],
+  "remotes": [
+    {
+      "type": "streamable-http",
+      "url": "https://usetimebook.com/mcp"
+    }
+  ],
   "packages": [
     {
       "registryType": "npm",