How We Audited Model Context Protocol (MCP) Servers for SSRF: Lessons from 12 Responsible Disclosures