feat: serve the MCP server at /mcp on the local servers

Mount the local MCP server at /mcp on the development and preview
servers for clients that connect by URL. The route accepts only
requests from this machine that name a loopback host and, when an
Origin is sent, come from a loopback origin, and drains oversized
bodies so the 413 response is delivered. The provider-order regression
test now pins the route between the providers and the API fallback.

docs/CURRENT-STATE.md

@@ -6,6 +6,8 @@
 and `gods-eye-view/tools/mcp` exposes a composed catalog over the Model Context
 Protocol. `npm run mcp` serves Core's tools over stdio to a local MCP client,
 reading from a running app's `/api` routes (default `http://localhost:4173`).
+The development and preview servers also serve the tools over HTTP at `/mcp`,
+accepting only local requests with loopback hosts and origins.
 Queries cover earthquakes, active fires, recent launches, aircraft (in an
 area, by identifier, tracks, and type and route lookups), ships (in an area,
 by identifier, and tracks), satellites (next

docs/TOOLS.md

@@ -11,7 +11,7 @@ They are defined once and exposed through adapters; the Model Context Protocol
 | `src/tools/`         | Tool definitions, catalog composition, argument validation, shared `area` and result helpers      |
 | `src/tools/queries/` | Queries, one file per domain, reading only portable source contracts                              |
 | `src/tools/mcp/`     | MCP protocol (JSON-RPC) and a stateless HTTP transport; knows the catalog interface, not queries |
-| `server/mcp/`        | Node composition: points the sources at a running app's `/api` routes and serves stdio           |
+| `server/mcp/`        | Node composition: points the sources at a running app's `/api` routes; serves stdio and `/mcp`  |
 
 Dependencies point downward only. `gods-eye-view/tools` and
 `gods-eye-view/tools/mcp` are portable exports: they reach no application,
@@ -84,7 +84,18 @@ server with an MCP client, for example Claude Code:
 claude mcp add gods-eye-view -- npm --prefix /path/to/gods-eye-view run --silent mcp
 ```
 
-`npm run mcp -- --api-base http://localhost:4173` selects another server. The
+`npm run mcp -- --api-base http://localhost:4173` selects another server.
+
+The development and preview servers also serve the same tools over HTTP at
+`/mcp`, for clients that connect by URL:
+
+```bash
+claude mcp add --transport http gods-eye-view http://localhost:4173/mcp
+```
+
+The route accepts only requests from this machine that name a loopback host
+and, when a browser sends an `Origin`, come from a loopback origin. This is
+local transport safety, not authentication. The
 local server makes no requests other than to the app's `/api` routes and the
 public feeds the sources already use.