Harden the local MCP HTTP transport

[tninja]

Summary

Tighten validation at the local MCP HTTP boundary before requests reach the MCP dispatcher.

Changes

• Add TDD coverage for invalid paths, unknown sessions, content types, JSON-RPC envelopes, and oversized bodies.
• Require exact /mcp/<session-id> paths and an existing registered MCP session.
• Require application/json request content.
• Cap request bodies at 1 MiB by default, including early rejection from Content-Length.
• Validate JSON-RPC 2.0 request envelopes before dispatch.
• Return appropriate HTTP status codes for bad requests, oversized payloads, and unsupported media types.
• Preserve notification 202 behavior and existing request-id handling for dispatcher failures.

Validation

• unit-tests: passed.
• melpazoid: passed.

Focused validation tests were committed before implementation. Existing HTTP transport tests were adjusted only to construct requests that satisfy the newly explicit transport contract.