feat: support shared MCP server sessions - #2733

Why

Addresses #2188. Multiple MCP clients need to drive one long-lived Chrome without spawning one Chrome-connected server per client, leaking orphaned processes, contending for profiles, or sharing selected-page and filesystem state.

What changed

• add a loopback-only Streamable HTTP endpoint at http://127.0.0.1:<port>/mcp via --http-port
• create an independent McpServer and McpContext for every HTTP session while sharing one process-level Chrome connection and page inventory
• isolate selected pages, roots, named isolated contexts, DevTools resource loading, tracing/recording state, telemetry attribution, and per-client request mutexes
• add --server-url / CHROME_DEVTOOLS_MCP_SERVER_URL as a transparent stdio-to-HTTP proxy for stdio-only clients
• preserve existing stdio mode when neither option is supplied
• support server-launched headed/headless Chrome, --auto-connect, and explicit remote-debugging --browser-url / --ws-endpoint modes

Lifecycle and security

• bind only to 127.0.0.1; reject non-loopback Host and Origin
• cap request bodies at 4 MiB and bound pending/established sessions
• close only the addressed session on accepted DELETE; inactive sessions expire after 30 minutes while active requests/streams suspend expiry
• drain active tools and stop session-owned traces, screencasts, and owned isolated browser contexts before disposal
• document SSH port forwarding as the only remote-access path

Verification

• npm run format
• focused shared HTTP/proxy/browser/context/telemetry run: 169 passed
• npm run test tests/http-server.test.ts tests/proxy.test.ts tests/http-multi-client.test.ts: 10 passed
• npm run test -- --retry: final attempt 1,036 passed, 3 platform skips; earlier attempts hit existing extension teardown/network ordering flakes
• live smoke: two named chrome-devtools-axi sessions opened separate tabs through one service, saw the same page inventory, and retained different selected pages

Companion

AXI upstream: kunchenguid/chrome-devtools-axi#139

Fork review PRs: lmn451#3 and lmn451/chrome-devtools-axi#1

Supersedes the narrower per-session-browser approach in #2730.