Add Streamable HTTP MCP transport with CORS, Auth passthrough, and env-based config

[milichev]

Description

This PR adds an optional Streamable HTTP MCP transport alongside the existing stdio transport.
When MCP_TRANSPORT=http is set, the server listens on a configurable host/port and serves MCP over HTTP, enabling browser-based clients such as MCP Inspector to connect without subprocess management.

Why?

Important

Stdio transport binds the MCP server's lifecycle to the client process.

The client spawns the server as a subprocess and owns its stdin/stdout, making it impossible to attach a debugger, use watch/hot-reload (npm run dev), or reconnect without restarting the client. HTTP transport decouples the two: the server runs independently, the client connects over the network. This also enables cross-host connectivity (e.g. server in a container, client on the host) without an additional reverse proxy layer.

Key changes:

• src/mcp/http-transport.ts — HTTP server, stateless per-request clone+transport, CORS with origin reflection, res.on("close") cleanup.
• src/mcp/proxy.ts — clone(requestHeaders?) factory; shared state object (operations log flag + serverInfo) across clones; opaque error wrapping; dead PathItemObject/getContentType still present (next PR).
• src/client/http-client.ts — withHeaders() clones by value, injects baseHeaders at requestConfig level; structured Axios error logging; debug console.errors removed.
• src/utils/proxy-config.ts — Zod schema for all env vars; discriminated union transport config; passthroughHeaders whitelist.
• Base URL resolving aligned across MCP and generating Key commands.
• README.md — env vars table + HTTP mode dev section.
• Tests: proxy-config, base-url, http-client tests updated/fixed.

Pending / next PR candidates:

1. Context bloat (tool descriptions re-sent every call) — the stated top priority, not yet addressed.
2. pino logging migration replacing remaining console.error calls.
3. serverInfo.version sourced from OpenAPI spec date string — arguably should be npm package version.

Tip

Items 1 & 3 are implemented/fixed in milichev#2, which waits till this PR is merged

To start in HTTP mode:

MCP_TRANSPORT=http MCP_HOST=127.0.0.1 MCP_PORT=3666 npm run dev

Then connect MCP Inspector to http://127.0.0.1:3666/mcp.

What type of PR is this? (check all applicable)

• 🍕 Feature
• 🧑‍💻 Code Refactor

Related Tickets & Documents

N/A

Mobile & Desktop Screenshots/Recordings

N/A — server-side only, no visual changes.

Added tests?

• 👍 yes

Added to documentation?

• 📜 README.md

• 🙅 no documentation needed

• I understand that contributing to this repository will require me to agree with the CLA

[SuperOlle]

Any update on this?