fix: surface missing [mcp] extra guidance

[ded-furby]

Summary

Adds a preflight signal for the optional [mcp] extra and turns the mcts-mcp startup failure into an actionable install hint.

Fixes #219.

Type of change

• Bug fix
• New feature / analyzer
• Breaking change
• Documentation

Test plan

• uv run pytest
• uv run ruff check src tests
• Manual CLI test (if applicable)

  uv run mcts scan examples/vulnerable-mcp-server/server.py
  uv run mcts scan examples/vulnerable-mcp-server/server.py -o report.json
  uv run mcts report report.json -o security-report.html

uv run pytest tests/test_doctor.py tests/test_mcp_server.py passed for the touched paths.

uv run pytest was also run after uv sync --all-extras; it reached the full suite and failed in an unrelated existing test:
tests/test_skills_inventory.py::test_discover_skills_from_project_dir expected 1 discovered skill entry and got 9.

Checklist

• CHANGELOG.md updated (if user-facing) — see Keep a Changelog
• Tests added or updated
• No secrets or credentials in code
• Docs updated if CLI behavior or report output changed — see Documentation index (guides live under docs/get-started/, docs/scanning/, docs/platform/, etc.)

[hello-args]

Addresses #219 well, showing [mcp] on plain mcts doctor (not just --deep) is what people need before live scan or mcts-mcp. The clearer create_server error is a nice touch too.

@ded-furby please resolve the CHANGELOG conflict and get CI green.

Heads-up: #233 also adds [mcp] doctor checks. If both land, dedupe so --deep doesn’t report [mcp] twice, and grab Rich escape() for the label so [mcp] doesn’t get eaten.

LGTM once conflicts are fixed and CI passes.