Register Penpot's MCP server, whose token rides in the URL

Penpot's MCP server reads the user key only from the userToken query
parameter, never a header. link-mcp now substitutes a {TOKEN} placeholder
in a server's URL instead of sending the Authorization header, and the
servers list gains a penpot row that uses it.

setup/scripts/link-mcp

@@ -69,6 +69,9 @@ while read -r name transport url token_var _rest; do
         continue
     fi
 
+    # The token normally travels as an Authorization header. A server that only
+    # reads it from the query string (Penpot's userToken) marks the spot with
+    # {TOKEN} in its URL instead, and gets no header.
     header=()
     if [[ -n "${token_var:-}" ]]; then
         token="${!token_var:-}"
@@ -77,7 +80,11 @@ while read -r name transport url token_var _rest; do
             skipped=$((skipped + 1))
             continue
         fi
-        header=(-H "Authorization: $token")
+        if [[ "$url" == *'{TOKEN}'* ]]; then
+            url="${url//\{TOKEN\}/$token}"
+        else
+            header=(-H "Authorization: $token")
+        fi
     fi
 
     # Re-registering is how this stays idempotent across upgrades, and how a