feat(mcp): headers for HTTP MCP servers

[yuanhao]

Closes #275.

let transport = HttpTransport::new(url)?
    .with_header("authorization", format!("Bearer {token}"))?;
let agent = agent.with_mcp_server_http_transport(transport).await?;
// or: McpClient::connect_http_with(transport).await?

Per the issue:

• Headers go on every request of the session — initialize, notifications/initialized, tool calls and the closing DELETE — through one private request(Method) helper used by all three paths.
• Invalid name or value → error before anything is sent; the value is never echoed. Setting a name twice replaces it.
• Names the transport sets itself are refused: Accept, Content-Type, Mcp-Session-Id.
• Every custom value is marked sensitive.
• HttpTransport::new, connect_http and with_mcp_server_http behave as before (they now delegate to the new constructors).
• wasm32: compiles and lints clean; the headers ride on the host's fetch.
• Out of scope: tokens that change mid-session.

Tests (tests/mcp_http_transport_test.rs): a server that 404s without the headers — a full session through McpClient::connect_http_with (all five requests carry both headers, checked per request since close tolerates a rejected DELETE; mutation-checked by sending the DELETE without them); an agent connecting through with_mcp_server_http_transport and calling the discovered tool; the same server refusing a plain connect; refusals (bad name, CRLF value not echoed, reserved names any case); replacement; a plain transport sending no auth/User-Agent; a unit test that values are sensitive. Full suite: 1524 passed. Docs: MCP guide "Servers that need headers", Workers guide, CHANGELOG, CLAUDE.md.

This is the general version of what #271 needed (caller identification).

🤖 Generated with Claude Code

https://claude.ai/code/session_01T7iq5hpndSiHQcnAsywKuG