Add single-port combined HTTP+MCP mode (serve-all) for PaaS deployment

[devin-ai-integration]

Summary

Enables running the node on platforms that expose one port with platform-terminated TLS (Fly.io), which is what the live deployment uses.

• transport/combined.py: create_combined_app(node, settings) = FastAPI PIP routes + build_mcp_http_app(...) mounted at /, so /mcp is served by MCP while /healthz, /.well-known/pip, /pip/v1/inbox, /metrics stay FastAPI. create_app gained lifespan= so the MCP session manager's lifespan runs inside the FastAPI app (same bug class fixed in Add production deployment setup (Docker, compose, deploy script, health checks, docs) #2).
• pip-node serve-all CLI + serve-all entrypoint case.
• Root main.py for uvicorn main:app source deploys: honors PORT; derives PIP_PUBLIC_HTTP_URL/PIP_PUBLIC_MCP_URL from FLY_APP_NAME; uses /data/instance.key + sqlite:////data/pip.db when a writable /data volume exists; binds 0.0.0.0 under a platform proxy (also disables MCP's loopback-only DNS-rebinding Host check, which would otherwise 421 public requests).
• deploy/fly.toml.example, DEPLOYMENT.md "Single-port / PaaS mode", CHANGELOG 1.2.0; mypy now covers main.py.

Tests: tests/test_combined.py (combined routing, MCP initialize through the combined app, bearer gating, main under Fly env). 126 passed, ruff/mypy clean.

Link to Devin session: https://app.devin.ai/sessions/4104d923252c419994b9ebddc2f28bec
Open in Devin Desktop: https://app.devin.ai/desktop/session/4104d923252c419994b9ebddc2f28bec?variant=devin
Requested by: @CommunityPoke

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring