feat: serve the MCP server at /mcp on the local servers

Mount the local MCP server at /mcp on the development and preview
servers for clients that connect by URL. The route accepts only
requests from this machine that name a loopback host and, when an
Origin is sent, come from a loopback origin, and drains oversized
bodies so the 413 response is delivered. The provider-order regression
test now pins the route between the providers and the API fallback.

CHANGELOG.md

@@ -1,6 +1,8 @@
 # Changelog
 
-- Add tools for language-model clients and a local MCP server. `npm run mcp`
+- Add tools for language-model clients and a local MCP server, served over
+  stdio by `npm run mcp` and over HTTP at `/mcp` on the development and preview
+  servers for local requests only. `npm run mcp`
   serves earthquake, active-fire, launch, aircraft, ship, satellite, camera, radio,
   place, routing, bike-share, transit, traffic, weather, cyclone, fire-perimeter,
   terrain, installation and map-feature queries, plus a situation brief, over