fix: mcp-server baseURL precedence and blocked-method regex case

[BhariGowda]

Two independently verified correctness bugs in the hand-written MCP server code. Neither has an attack path security findings are being handled separately via responsible disclosure.

1. ??/?: operator precedence discards explicit COINGECKO_BASE_URL (remote-sandbox-handler.ts:46)

Due to ?? binding tighter than ?: in JavaScript, the expression:

readEnv('COINGECKO_BASE_URL') ?? environment ? undefined : client.baseURL ?? undefined

parses as (readEnv('COINGECKO_BASE_URL') ?? environment) ? undefined : (client.baseURL ?? undefined).

When COINGECKO_BASE_URL is explicitly set and COINGECKO_ENVIRONMENT is not, the configured value is silently discarded and undefined is sent to the remote sandbox instead. Since the sandbox is a separate process with no other way to learn this value, a user's custom base URL (e.g. a self-hosted mirror or staging server) is genuinely lost.

Verified: before fix returns undefined, after returns the configured URL.

Fix: add parentheses to express the intended logic.

2. Default codeBlockedMethods regexes are snake_case but method names are camelCase (options.ts:50)

The default block list uses coins\.circulating_supply_chart\..* and coins\.total_supply_chart\..*, but actual fully-qualified method names are camelCase (coins.circulatingSupplyChart.get, etc.). Verified against the real 87-method list: both patterns match 0 methods. The advertised default block on circulating/total-supply-chart endpoints is silently a no-op.

Fix: update defaults to match actual camelCase method names.

Testing: Root yarn test 217 passed, 160 skipped (live-API tests requiring keys), 0 failed. mcp-server jest 2 passed, 0 failed. Exactly 2 files changed, no generated or security-related files touched.

Note: a third fix (invalid JSON in publish-npm.yml manual dispatch workflow) requires workflow scope and will be filed separately.