TOOLS-137: Allow explicit private HTTP MCP upstreams

[averycrespi]

Context

Stacked on #166 (avery/tools-136-remote-oauth), not main. Incremental base: f2ca07dc9129e26671810b572223641d62ad8345.

TOOLS-137 enables unauthenticated MCP services such as http://notes-mcp:8080/mcp on operator-controlled private networks without a global security bypass.

Changes

• Add persisted, strict per-server allow_private_http configuration across API, CLI JSON input, and browser create/edit forms. Existing definitions default to denial.
• Admit only RFC 1918 IPv4 and IPv6 ULA; validate every fresh DNS answer and dial a validated numeric address directly. Reject public plaintext, metadata/link-local, CGNAT, multicast, unspecified and mixed invalid answers.
• Keep bearer/OAuth HTTPS-only, preserve loopback behavior and existing HTTPS restrictions, and fence old runtimes/capabilities when policy changes.
• Add persistence, input, DNS, authentication, driver and revocation regression coverage, plus operator/normative guidance and downstream container qualification seams.

Review Notes

This is outbound MCP policy only, not inbound --allowed-host or HTTP/Git grant expansion. Plaintext is unauthenticated and unencrypted; custom headers remain nonsecret configuration.

Docker packaging and separate-container service-name execution belong to TOOLS-138/139. No local Docker, live Debian, installed-resource or provider qualification is claimed. Independent incremental review precedes publication; promotion requires exact-head target-applicable CI.

Two unrelated real-browser credential scenarios initially failed transient assertions, then passed focused diagnosis and the complete unchanged-source Chromium aggregate. No causal fix is claimed. An initial integration run used umask077, which masked deliberately unsafe path fixture modes; those owners passed with umask022 and the remaining exact integration inventory passed. Original failures are retained in delivery evidence.

The initial CI E2E run exposed a held-invocation snapshot timing failure. A test-only repair uses the existing catalog-poll quiet-window harness without changing assertions or production behavior. Focused race tests, all quiet-window boundaries, make verify, the complete E2E owner, and independent repair review passed. Catalog-poll causation fits the observed timing and withdrawal path but was not directly traced; the original failure remains retained. Full incremental and focused repair reviews found no material issues.

Test Plan

• make -C agent-gateway verify and local pre-commit hooks
• Focused changed-owner go test -race -count=1 -timeout=5m regressions
• Complete cumulative unit/integration inventory, harness, material, demo, E2E and security leaves (integration pass union after the fixture-mode correction above)
• npm run format:check, ui:typecheck, ui:build, ui:verify-generated, ui:verify-supply-chain, ui:test-dev (187 tests)
• npm run ui:test-browser (31 owners); make -C agent-gateway test-browser (workflow, privacy, visual, accessibility)
• Actual desktop/narrow light/dark PNG inspection for opt-in, confirmation, credential error and persisted/cleared edit states
• go -C agent-gateway tool govulncheck ./..., npm run ui:audit, outgoing history/metadata secret scan
• All 16 exact-head checks, including Required, passed for b214c6c090dfad2f5d3632a86402da7136f763db: CI run
• Named TestProxyIPv6SocketFallback positive PASS on exact-head Ubuntu integration-2 (job log); local unavailable-loopback skip remains disclosed