Fix gRPC auth: inject bearer token via PerRPCCredentials

The gRPC client was not sending the authorization header, causing
"missing authorization header" errors even when a token was configured.
Also fix config test to isolate from real ~/.config/mcrctl.toml.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

cmd/mcrctl/config_test.go

@@ -38,7 +38,9 @@ ca_cert = "/path/to/ca.pem"
 }
 
 func TestLoadConfigMissingDefaultIsOK(t *testing.T) {
-	// Empty path triggers default search; missing file is not an error.
+	// Point XDG_CONFIG_HOME at an empty dir so we don't find the real config.
+	t.Setenv("XDG_CONFIG_HOME", t.TempDir())
+
 	cfg, err := loadConfig("")
 	if err != nil {
 		t.Fatal(err)