fix(websearch): use Bearer auth for Exa MCP

Switch from query-param (?exaApiKey=...) to Authorization: Bearer header
for Exa MCP authentication. The MCP SDK's SSE endpoint resolution discards
query parameters when the server replies with a relative path, causing
EXA_API_KEY to be silently lost and falling back to rate-limited free tier.

Bearer auth via header survives URL resolution and is consistent with the
Tavily MCP config pattern already in use.

Fixes #3763
Relands #4090 (CLA unsigned by original author)

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Minsoo Choi <Neo1228@users.noreply.github.com>
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

src/mcp/websearch.ts

@@ -32,11 +32,9 @@ export function createWebsearchConfig(config?: WebsearchConfig): RemoteMcpConfig
 
   return {
     type: "remote" as const,
-    url: process.env.EXA_API_KEY
-      ? `https://mcp.exa.ai/mcp?tools=web_search_exa&exaApiKey=${encodeURIComponent(process.env.EXA_API_KEY)}`
-      : "https://mcp.exa.ai/mcp?tools=web_search_exa",
+    url: "https://mcp.exa.ai/mcp?tools=web_search_exa",
     enabled: true,
-    ...(process.env.EXA_API_KEY ? { headers: { "x-api-key": process.env.EXA_API_KEY } } : {}),
+    ...(process.env.EXA_API_KEY ? { headers: { Authorization: `Bearer ${process.env.EXA_API_KEY}` } } : {}),
     oauth: false as const,
   }
 }