feat(mcp): add --host flag for MCP HTTP transport bind address (#254)

Add a --host CLI flag to 'obscura mcp --http' so the server can bind to
addresses other than 127.0.0.1 (e.g. 0.0.0.0 for Docker Compose sidecar
deployments). The default remains 127.0.0.1 for security.

Closes #253

crates/obscura-mcp/src/http.rs

@@ -10,10 +10,10 @@ use crate::{dispatch, BrowserState};
 /// Connections are handled sequentially on the current thread — the browser
 /// session (including the V8 runtime) is single-threaded and `!Send`, so we
 /// never need to move state across threads.
-pub async fn run(port: u16, proxy: Option<String>, user_agent: Option<String>, stealth: bool) -> Result<()> {
-    let addr = std::net::SocketAddr::from(([127, 0, 0, 1], port));
+pub async fn run(host: String, port: u16, proxy: Option<String>, user_agent: Option<String>, stealth: bool) -> Result<()> {
+    let addr: std::net::SocketAddr = format!("{}:{}", host, port).parse()?;
     let listener = TcpListener::bind(&addr).await?;
-    tracing::info!("MCP HTTP server on http://127.0.0.1:{}/mcp", port);
+    tracing::info!("MCP HTTP server on http://{}:{}/mcp", host, port);
 
     let mut state = BrowserState::new(proxy, user_agent, stealth);
 

crates/obscura-mcp/tests/cors_preflight.rs

@@ -27,7 +27,7 @@ async fn options_preflight_lists_required_browser_headers() {
     // end of the test. `current_thread` + LocalSet is required because the
     // browser state is `!Send` (Page holds V8 handles).
     let server = local.spawn_local(async move {
-        let _ = obscura_mcp::http::run(port, None, None, false).await;
+        let _ = obscura_mcp::http::run("127.0.0.1".to_string(), port, None, None, false).await;
     });
 
     local.run_until(async {