Feature: add curated servers at runtime without a release #49

Problem

The curated server list (registry::curation::CURATED_SERVERS) is a compiled-in const. Adding a vendor server — the four Swiggy servers in #43 are the latest case — means a code change in tinymcp, a release, and a version bump in every host before the server appears in its directory. Nobody running a host can add, correct or remove a curated server without going through that cycle, and a vendor endpoint that moves stays wrong until the next release.

Proposed solution

Let a host supply curated servers at runtime, merged with the built-in list:

• A curated-servers config file the host points tinymcp at (a path in the registry settings, or an environment variable), each entry carrying the same fields as CuratedServer: qualified name, display name, description, remote URL, transport, auth, icon. Adding a server is an edit to that file and a restart; no release and no host version bump.
• Validation on load: https:// endpoint, known transport and auth, unique qualified names. An invalid entry is rejected with a reason rather than silently dropped.
• Runtime entries take part everywhere the built-in ones do today: badging (tag_official), official_first ordering, the curated lead on a first search page, the local-index merge, the timeout fallback, and the detail fallback when the registry has no record.
• A defined precedence when a runtime entry shares a qualified name with a built-in one.
• An OFFICIAL_SERVERS-equivalent accessor that reflects the merged list, since hosts read it to build their featured section.

Out of scope: any dashboard, settings screen or admin UI for managing entries. The config file is the whole interface; a host only passes its path through.

Alternatives considered

• Keep the compiled list and release more often. Every addition still waits on a release and a host bump.
• Fetch a curated list from a hosted URL. Removes the release step, but adds a network dependency and a trust question about who may publish to it.

Additional context

Today's merged search returns official-registry rows with curated servers leading page 1, then Smithery rows when a Smithery key is set. Curated entries are the only way a server absent from the official registry (Slack, Swiggy) reaches a host's directory.