feat(mcp): add local streamable HTTP transport (#1120)

## Description
Adds a local-first Streamable HTTP MCP entrypoint at `@codemem/mcp/http` exposing `POST /mcp` using the shared MCP server factory from the previous PR.

The transport defaults to loopback, rejects unsafe non-loopback binds unless explicitly opted in, validates Host/Origin against loopback and the bound port, creates a fresh stateless MCP server/transport per request, and shuts down idempotently. OAuth is intentionally not included in this slice.

## Type of Change

- [x] 🚀 Feature (new functionality)
- [ ] 🐛 Bug fix (fixes an issue)
- [ ] 📚 Documentation (docs-only change)
- [ ] 🔧 Maintenance (refactor, chore, CI, etc.)
- [x] 🧪 Testing (test-only changes)

## Testing

- [x] Relevant checks pass locally (`pnpm run tsc`, `pnpm run lint`, `pnpm run test`)
  - `pnpm --filter @codemem/mcp typecheck`
  - `pnpm --filter codemem typecheck`
  - `pnpm exec vitest run packages/mcp-server/src/server.test.ts packages/mcp-server/src/memory-access.test.ts packages/mcp-server/src/project-scope.test.ts packages/mcp-server/src/http.test.ts`
  - `pnpm --filter @codemem/mcp build` plus `./http` output/shebang/export verification
- [x] Added/updated tests for changes
- [x] Manually verified changes work as expected

## Checklist

- [x] Code follows project style (`pnpm run lint` passes for touched files)
- [x] Self-review completed
- [x] Documentation updated (if needed)
- [x] No new warnings introduced