Phase 4 distribution audit: server-card.json + auth-wall findings

- Add /.well-known/mcp/server-card.json (Smithery auto-scan endpoint)
- Sitemap.xml now lists both well-known endpoints
- JOURNAL.md: full audit of marketplace auth walls (mcpservers.org=$39, mcp.so/smithery/glama=login)
- JAOUAD_TODO.md: updated with concrete copy-paste instructions for the 3 directories
- STATE.md: phase 4 marked blocked by auth walls until human steps in
- deploy/inspect_*.py + submit_mcpservers.py: playwright probes (kept for re-runs)

.gitignore

@@ -5,3 +5,4 @@ data/.wallet_pass
 data/.vps_secrets
 __pycache__/
 *.pyc
+data/*.html