Session token validation, multi-instance support, and project metadata

[biterik]

Summary

Integrates work that was built on the original scaffold onto the current main. Three themes:

1. Token validation + actionable help (the original ask)

• The personal access token is validated against the server on first use in a session (inside OpenbisClient.connect(), which caches — so it runs once and adds no per-call overhead).
• An expired/invalid token (or a failed username/password login) raises OpenbisAuthError whose message contains step-by-step instructions for creating a new token in the openBIS web UI and where to store it (.env, MCP client env block, or *_TOKEN_FILE).
• New check_authentication tool surfaces this proactively — checks all configured instances, or a named one.

2. Multiple openBIS instances

• Configure additional servers with an OPENBIS_<NAME>_* prefix (supports _TOKEN, _TOKEN_FILE, _USERNAME, _PASSWORD, _VERIFY_CERTIFICATES).
• A ConnectionManager owns one lazy client per instance; every openBIS tool gains an optional instance argument, plus a new list_instances tool.
• Fully backward compatible: the bare OPENBIS_* vars define a default instance, so existing single-server setups need no changes.

3. Project metadata (completes the licensing the repo already started)

The MPL-2.0 LICENSE file already exists, but pyproject.toml still had the old author / no license field and the README said "currently unlicensed". This PR makes it consistent:

• license = { file = "LICENSE" } + MPL classifier in pyproject.toml; SPDX/author headers on all source files.
• Authors updated to Erik Bitzek (e.bitzek@mpi-susmat.de) and Niklas Siemer.
• New CITATION.cff (includes DFG funding acknowledgement); README Authors / Citation / License / Funding sections.
• README + .env.example document the new tools, the instance argument, and multi-instance configuration.

Testing

• pytest: 32 passed, 1 failed — the one failure (test_s3_get_file_metadata) is pre-existing and environmental (xxhash from the optional [s3] extra is not installed); it is unrelated to this diff (our only change to s3_support.py is the license header).
• Added tests for token validation, PAT-help text, instance discovery (incl. token-file), default resolution, unknown/ambiguous-instance errors, instance routing, and check_authentication.

Notes for review

• instance is appended as a trailing optional parameter on each tool, so existing tool calls are unaffected.
• The LICENSE file on main is untouched.

🤖 Generated with Claude Code