fix: correct MCP SDK import paths for TransportSecuritySettings and app startup

- TransportSecuritySettings lives in mcp.server.fastmcp.server, not utilities.types
- Use mcp.run(transport="streamable-http") instead of get_app() + uvicorn
- Use @mcp.custom_route for REST endpoints instead of mounting on starlette app

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

app/server.py

@@ -10,7 +10,7 @@ import logging
 from contextlib import asynccontextmanager
 
 from mcp.server.fastmcp import FastMCP
-from mcp.server.fastmcp.utilities.types import TransportSecuritySettings
+from mcp.server.fastmcp.server import TransportSecuritySettings
 
 from tpp_client import TPPClient, TPPError
 
@@ -426,16 +426,14 @@ async def transfer_domain(
 
 
 # =============================================================================
-# REST API endpoints (non-MCP, for direct HTTP access)
+# REST API endpoints via custom_route
 # =============================================================================
 
 from starlette.requests import Request
 from starlette.responses import JSONResponse
 
-app = mcp.get_app()
 
-
-@app.get("/api/health")
+@mcp.custom_route("/api/health", methods=["GET"])
 async def health(request: Request) -> JSONResponse:
     """Health check endpoint."""
     configured = all([ACCOUNT_NO, USER_ID, PASSWORD])
@@ -446,7 +444,7 @@ async def health(request: Request) -> JSONResponse:
     })
 
 
-@app.get("/api/balance")
+@mcp.custom_route("/api/balance", methods=["GET"])
 async def api_balance(request: Request) -> JSONResponse:
     """Quick balance check via REST."""
     api_key = request.headers.get("x-api-key", "")
@@ -463,7 +461,7 @@ async def api_balance(request: Request) -> JSONResponse:
 
 
 if __name__ == "__main__":
-    import uvicorn
-
     port = int(os.environ.get("TPP_PORT", "8089"))
-    uvicorn.run(app, host="0.0.0.0", port=port)
+    mcp.settings.host = "0.0.0.0"
+    mcp.settings.port = port
+    mcp.run(transport="streamable-http")