docs: align MCP token endpoint

Author: kvz

docs/mcp-spec.md

@@ -53,7 +53,7 @@ This means we should add missing functionality to `@transloadit/node` first (see
 ### Hosted (`api2.transloadit.com/mcp`)
 
 - Auth: `Authorization: Bearer <mcp_token>`
-- Token minting endpoint: `POST https://api2.transloadit.com/tokens/mcp`
+- Token minting endpoint: `POST https://api2.transloadit.com/token`
 - Token format: opaque, 6-hour TTL.
 - Scopes (MVP):
   - `assemblies:write`

docs/mcp-todo.md

@@ -44,7 +44,7 @@ This list is ordered. The top section is intentionally focused on other packages
 
 ## 2. API2 groundwork
 
-- Implement `POST /tokens/mcp`:
+- Implement `POST /token`:
   - Accept key/secret auth.
   - Return opaque bearer token (TTL 6 hours) with scopes.
 - Accept MCP bearer tokens for Assembly endpoints used by the MCP server