**Version:** v1.92.0-dev.2 (same code path on `main`).

## Summary

`pre_mcp_call` guardrails run only on the tool path. `resources/read`, `resources/list`, and `prompts/get`/`list` reach the upstream MCP server without them. Two consequences:

1. **Auth:** with `mcp_jwt_signer` (`mode: pre_mcp_call`) enabled, `tools/call` gets a signed `Authorization: Bearer <JWT>` but `resources/read` does not — servers that verify that JWT reject resource reads while tool calls succeed. 2. **Broader:** no PII / security / semantic guardrails run on resource or prompt content either. A resource read returning secrets/PII is not filtered.

## Root cause

Tool path runs guardrails: `mcp_server_tool_call` → `execute_mcp_tool` → `pre_call_tool_check`.

Resource path does not: `read_resource` → `mcp_read_resource` → `read_resource_from_server` never runs `pre_call`, so `inject_mcp_jwt_headers_for_upstream` is never called. `_MCP_JWT_CALL_TYPES` is also limited to `{call_mcp_tool, list_mcp_tools}`.

## Reproduce

1. Register an HTTP MCP server and enable `mcp_jwt_signer` (`default_on: true`). 2. `tools/call` → upstream receives a signed `Authorization: Bearer <JWT>`. ✅ 3. `resources/read` on the same s…