fix: detect config changes for require_mcp_auth and handle residual edge cases

[AdamMagued]

Fixes #1466

This change addresses residual issues identified during the Spec 108/109 review:

1. In DetectConfigChanges, add detection for hot-reloadable fields including require_mcp_auth, quarantine_enabled, init_timeout, max_result_size_chars, forward_proxy_env, and debug_search. Previously, PATCH /api/v1/config with require_mcp_auth reported "No configuration changes detected" despite being applied live.
2. In loadRegistryConfig, propagate errors when an explicit config file is specified via -c or --config rather than unconditionally falling back to DefaultConfig.
3. In cli_config.go, call ApplyTLSEnvOverrides when falling back to default configuration under --data-dir so MCPPROXY_LISTEN and TLS settings are honored.
4. Export ApplyTLSEnvOverrides in internal/config to support CLI loaders.
5. In doctor_redact.go, permit apostrophes in URLs within doctorURLPattern so percent-encoded query credentials following apostrophes are redacted, while stripping and reattaching trailing quote punctuation.
6. In runImport, return an empty preview when previewing an empty JSON object ({}) so Quick-import paste previews succeed with HTTP 200.

[Dumbris]

Hi @AdamMagued, thank you for this, and for going back through #1466 for the leftover edge cases. You found six real gaps: require_mcp_auth and the other top-level fields not showing up in config-change detection, -c/--config errors being swallowed in the registry commands, env overrides being skipped on the --data-dir fallback, apostrophes in URLs in doctor redaction, and the {} import preview. Each one also came with a focused test. That's exactly the kind of audit that keeps a project honest.

I owe you an apology for the timing. While your PR was open, several maintainer PRs (#1435, #1472, #1496, #1505, #1529) fixed the same residuals in almost the same way. Sorry we duplicated your work instead of landing yours first. As a result, this branch now conflicts with main in four files, and some of the production changes would clash with what's there now:

• Hot-reload detection: main now reports require_mcp_auth, quarantine_enabled, init_timeout, max_result_size_chars and forward_proxy_env through a single loop (undiffedHotConfigFields). With your explicit clauses added as well, each changed field would appear twice in changed_fields.
• debug_search: on main this field is treated as restart-required, because it's bound once when the MCP server is built. So it's now detected with RequiresRestart=true, not hot-reloaded.
• Items 2–6 (registry -c error, --data-dir env overrides, TLS override helper, doctor apostrophe redaction, {} import preview) are already on main in near-identical form.

Your tests are still valuable. They lock in the behaviour for every residual you found, and nothing else covers that. So rather than ask you to redo anything, I pushed these small changes to your branch as maintainer, keeping your authorship:

1. Merged main and resolved the four conflicted files (cli_config.go, doctor_redact.go, registry_cmd.go, loader.go) to main's version.
2. Dropped the now-redundant production hunks in internal/runtime/config_hotreload.go and internal/httpapi/import.go.
3. Changed the debug_search subtest to expect a detected change with RequiresRestart=true, to match main's design.
4. Changed the DetectConfigChanges / config PATCH assertions from Contains to exact matches, so they'd also catch a field being reported twice or an unrelated field showing up.

With those changes the PR becomes a regression-test PR covering all of the #1466 residuals, and I'll merge it once CI passes. Thanks again for the careful audit and the tests. If you'd like to pick up more, I'd be glad to point you at an open issue, and I'll try to move faster on your next one.

[AdamMagued]

Thanks @Dumbris. The merge and assertion adjustments make complete sense with main's architecture—especially retaining restart-gated semantics for debug_search and tightening the ChangedFields assertions to exact matches.

I have verified the branch against the test suite, and all regression tests pass cleanly. Appreciate you preserving test authorship and keeping the coverage intact.