Remote transport hardening

[Alphanymous]

— the --transport http + --allowed-host feature is new and works, but has no built-in auth. A clean auth middleware layer (API key, or MCP-native OAuth) would make permanent remote deployments viable.