fix(mcp): filter credentials per-server in _embed_credentials

[aryanma]

_embed_credentials() was attaching all encrypted credentials to every server spec. Each server now receives only its own credentials, matched by connection name (slug.replace("/", "-")). API-side workaround removed in dedalus-labs/dedalus#9.

[cursor]

PR Summary

Low Risk
Small, localized change to request serialization that narrows credential exposure; risk is limited to potential mismatches in connection-name derivation causing missing credentials for some servers.

Overview
Fixes _embed_credentials so it no longer attaches the entire encrypted credentials map to every MCP server spec; instead it derives a per-server connection name (slashes -> dashes) and embeds only the matching credential (or None if absent).

Adds _server_connection_name() helper and updates server spec construction for both string and dict server entries to use per-server credential filtering.

^{Written by Cursor Bugbot for commit 1cb797e. This will update automatically on new commits. Configure here.}