feat: support shared MCP server sessions - #3

Summary

• add a loopback-only Streamable HTTP /mcp service with one MCP context per client session and one shared Chrome connection
• keep selected pages, roots, named isolated contexts, tracing/recording state, resource loading, telemetry attribution, and request mutexes session-scoped
• add a transparent stdio proxy for clients without native HTTP transport, including chrome-devtools-axi
• bound request bodies, pending/session counts, and abandoned-session lifetime; clean up session-owned browser work on DELETE
• document headless, headed, remote-debugging, SSH tunnel, native HTTP, stdio proxy, and AXI usage

Verification

• npm run format
• focused shared HTTP/proxy/browser/context/telemetry tests: 169 passed
• npm run test tests/http-server.test.ts tests/proxy.test.ts tests/http-multi-client.test.ts: 10 passed
• npm run test -- --retry: 1,036 passed, 3 platform skips (final retry; earlier attempts hit existing extension teardown/network ordering flakes)
• live smoke: two named chrome-devtools-axi sessions opened separate tabs through one HTTP service; both saw the same three pages while each retained its own selected page

Security

• listener fixed to 127.0.0.1
• non-loopback Host and Origin rejected
• 4 MiB request-body cap, bounded initializations/sessions, 30-minute inactive-session expiry
• remote access documented through SSH forwarding only

Companion AXI change

• feat: connect AXI to a shared MCP server chrome-devtools-axi#1

Related upstream request: ChromeDevTools#2188