feat(mcp): add streamable HTTP transport alongside stdio (#122) (#135)

Add opt-in `transport-http` Cargo feature to `mcpls-core` and
`mcpls-cli` that enables MCP 2025-11-25 Streamable HTTP transport.

- New `Transport` enum (`Stdio` | `Http(HttpConfig)`) controls the
  runtime binding; `serve()` is unchanged (stdio default)
- New `serve_with(config, Transport)` dispatches to `run_stdio` or
  `run_http` after shared LSP init
- `run_http` mounts `StreamableHttpService` on axum; graceful shutdown
  handles both SIGTERM and SIGINT for container deployments
- `--listen <ADDR>` CLI flag (env: `MCPLS_LISTEN`) and `--http-path`
  (env: `MCPLS_HTTP_PATH`, default `/mcp`) available with the feature
- Non-loopback bind emits a `tracing::warn!` about missing auth/TLS
- New deps (`axum 0.8`, `tokio-util 0.7`) are optional — default build
  pulls neither

Author: bug-ops

CHANGELOG.md

@@ -9,6 +9,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
+- **Streamable HTTP transport** — opt-in `transport-http` Cargo feature enables MCP 2025-11-25 Streamable HTTP transport; pass `--listen <addr>` (or set `MCPLS_LISTEN`) to bind a TCP port instead of using stdio; `--http-path` (default `/mcp`) controls the URL prefix (#122)
+
 - **MCP resources** — expose LSP diagnostics as subscribable MCP resources under the `lsp-diagnostics:///` URI scheme; clients can call `list_resources`, `read_resource`, `subscribe`, and `unsubscribe` (#115)
 - **Diagnostics push notifications** — background `diagnostics_pump` tasks relay `textDocument/publishDiagnostics` LSP notifications to subscribed MCP clients via `notifications/resources/updated`
 - **RFC-3986 URI codec** — `bridge::resources` module with percent-encoding via `url::Url::from_file_path`; empty-authority injection is rejected to prevent UNC-path attacks on Windows