fix: update MCP access docs to reflect per-key grants support

PR #117 follow-up (verify PASS-WITH-FINDINGS):

1. infrastructure-update.prose.md:
   - Update access table: agent keys now have per-key MCP grants (2026-09-18)
   - Strike-through old limitation: per-key grants now work
   - Mark Migration Path as COMPLETED 2026-09-18

2. hermes-config-template.prose.md:
   - Remove hedge ('may have been upgraded')
   - State fact: per-key MCP grants verified 2026-09-18

This resolves the contradiction where one file asserted per-key
MCP access and the other denied it.

hermes-config-template.prose.md

@@ -243,8 +243,8 @@ MCP server entries in `mcp_servers:` must follow the format shown in the Templat
 - Tested MCP initialize handshake against litellm.sysloggh.net/mcp with agent virtual key
 - Confirmed: 200 response with `serverInfo.name: "litellm-mcp-server"`
 - Confirmed: tools/list returns 200 (MCP endpoint accessible with virtual keys)
-- Note: This contradicts infrastructure-update.prose.md:214 ("only master key has access") —
-  the LiteLLM version may have been upgraded since that contract was written
+- Note: Per-key MCP grants are now supported (verified 2026-09-18), resolving the earlier
+  contradiction with infrastructure-update.prose.md (which now reflects the update)
 - Key requirement: must be a valid LiteLLM virtual key (HTTP 200 on /v1/models)
 
 **Key rotation note:**