fix(adk): allow internal MCP gateway requests

[Yilialinn]

What

Add the explicit unauthenticated opt-out to the ADK demo's MCP Gateway.

Why

Current Docker MCP Gateway releases require Bearer authentication for SSE by default. The ADK client in this demo does not configure an authorization header, so the Fact Checker receives 401 responses.

The gateway port is not published to the host and is reachable only from services attached to the demo's Compose network, so this opt-out is scoped to the local example network.

Validation

• docker compose -f adk/compose.yaml config --quiet
• git diff --check
• Confirmed the rendered Compose configuration does not publish an MCP Gateway host port
• Independently reproduced the 401 behavior and the --allow-unauthenticated fix with the current MCP Gateway image

The repository's default remote MCP catalog currently triggers a separate Docker Desktop DNS safety check on the validation Mac. That issue is independent of the authentication change and prevented a fresh end-to-end rerun of the unmodified public command.

Fixes #162