MCP Enterprise Security: A Practical Architecture and Lessons to Avoid Being Pwned