feat: add Streamable HTTP transport for MCP server

[andreimarinescu]

Summary

Adds a Streamable HTTP transport to Otto's MCP server alongside the existing stdio transport, mirroring the integration path Ideon recently shipped. Both transports expose the identical tool set via a shared registerOttoTools().

• otto mcp serve — stdio (unchanged behavior; previously the top-level otto mcp)
• otto mcp serve-http --api-key <key> [--port 3001] [--host 127.0.0.1] [--endpoint /mcp] — Streamable HTTP

The HTTP endpoint uses StreamableHTTPServerTransport with per-session transports keyed by Mcp-Session-Id, bearer-token auth (OTTO_MCP_API_KEY), and allowed-origin validation.

Changes

• New packages/cli/src/mcp/http-middleware.ts — createBearerAuthMiddleware + createOriginValidator.
• New packages/cli/src/mcp/http-server.ts — Express app, session map, startOttoMcpHttpServer.
• Refactor mcp/server.ts — extract registerOttoTools() (shared by both transports); fix serverInfo.version resolution (was reporting 0.0.0).
• CLI index.ts — otto mcp → serve / serve-http subcommands.
• Agent install — stdio writers now use mcp serve; ChatGPT setup points at the HTTP endpoint.
• Docs — otto mcp serve / serve-http across the command reference and agent guides.
• Deps — express, cors (+ types).

Test plan

• npm run check, npm run lint, npm run test:coverage all green (lines 92.61% / branches 90.47%, exit 0).
• New unit tests for the auth + origin middleware (mcp-http-server.test.ts).
• Manual end-to-end against a live serve-http:
  • Auth: no token → 401, wrong token → 403, bad Origin → 403, valid → 200 + Mcp-Session-Id.
  • Sessions: non-init POST w/o session → 400; GET w/o or unknown session → 400; GET SSE w/ session → 200; DELETE → 200.
  • Full round-trip: tools/call otto_status returns structured content; tools/list → all 25 tools over both HTTP and stdio.

Notes

• Stdio remains the default for otto agent install; HTTP is the manual option for ChatGPT / remote / container hosts (mirrors Ideon).
• http-server.ts is transport glue (binds a port), so — like the existing mcp/server.ts — it's covered by manual/integration testing rather than the unit-coverage gate.

🤖 Generated with Claude Code

[codecov-commenter]

Welcome to Codecov 🎉

Once you merge this PR into your default branch, you're all set! Codecov will compare coverage reports and display results in all future pull requests.

Thanks for integrating Codecov - We've got you covered ☂️