README accuracy pass: fix mcp-remote header pattern, add skill install steps

The Desktop config examples showed an inline 'Authorization: Bearer ...' header, which Claude Desktop breaks by splitting args on spaces — replace with the verified env-var pattern (Authorization:${MCP_AUTH_HEADER}, no space). Also: document how the skill is installed/discovered in Claude Code, note the person command in the CLI summary, and correct /health description (it now reports the secret-expiry countdown).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

mcp-server/README.md

@@ -91,16 +91,18 @@ Desktop:
         "-y", "mcp-remote",
         "http://192.168.101.12:3838/mcp",
         "--allow-http",
-        "--header", "Authorization: Bearer ${SP_MCP_TOKEN}"
+        "--header", "Authorization:${MCP_AUTH_HEADER}"
       ],
-      "env": { "SP_MCP_TOKEN": "<your MCP_AUTH_TOKEN>" }
+      "env": { "MCP_AUTH_HEADER": "Bearer <your MCP_AUTH_TOKEN>" }
     }
   }
 }
 ```
 
 `--allow-http` permits the plain-HTTP LAN URL (no TLS). The token must match the
-container's `MCP_AUTH_TOKEN`.
+container's `MCP_AUTH_TOKEN`. The header value goes through the env var (with the
+`Bearer ` prefix) and there is **no space after `Authorization:`** — Claude
+Desktop splits config args on spaces, so an inline `Bearer <token>` breaks.
 
 ### Claude Desktop → local stdio (no container)
 
@@ -124,6 +126,7 @@ The repo-root `.mcp.json` registers the local stdio server automatically.
 - App-only auth = the server has full access to the granted SharePoint sites
   with no per-user check. Anyone who can reach an unauthenticated `/mcp` has that
   access — always set `MCP_AUTH_TOKEN` for the HTTP transport.
-- `/health` is intentionally unauthenticated (liveness only; returns no data).
+- `/health` is intentionally unauthenticated (liveness + secret-expiry countdown
+  only; no secrets).
 - Field formats for writes (person/lookup/choice/date) are in
   `../.claude/skills/sharepoint-lists/references/graph-api.md`.