fix(mcp): serve both IPv4 and IPv6 loopback on the default HTTP host

[yotamleo]

Impact

qmd mcp --http (and --daemon) listens on only ONE loopback family by default. startMcpHttpServer defaults the host to "localhost" and calls httpServer.listen(port, "localhost"). That binds only the first address localhost resolves to, which is ::1 on typical modern Linux hosts. Any client that connects to http://127.0.0.1:<port>, or resolves localhost IPv4-first, gets ECONNREFUSED while the daemon is healthy.

Repro

At upstream main 04e4dbd, on a Linux host where localhost resolves to ::1 first:

qmd mcp --http --daemon
ss -ltnp | grep 8181               # [::1]:8181 only
curl -s -o /dev/null -w '%{http_code}\n' http://127.0.0.1:8181/mcp   # 000 (refused)
curl -s -o /dev/null -w '%{http_code}\n' 'http://[::1]:8181/mcp'     # 405

Fix

When the resolved host is the default "localhost", bind 127.0.0.1 first, then ::1, with the same request handler and on the same port. When 0 is requested, the second listener reuses the actual port the first one got.

• Missing address family: if one family is unavailable (EADDRNOTAVAIL / EAFNOSUPPORT, e.g. IPv6 disabled), the server continues on the listener that bound.
• Other bind errors: any other error (notably EADDRINUSE on either address) closes whatever already bound and rejects, so a port collision still fails loudly.
• Explicit host: an explicit --host / QMD_HOST (127.0.0.1, ::1, 0.0.0.0, …) keeps today's single listener.
• Shutdown: stop(), and handle.httpServer.close(), release every listener. port stays a single number.
• Docs: the README and the doc comment now describe the default.

The origin/Host guard already accepted all three loopback spellings. A unit test now pins that.

Tests

test/mcp-http-loopback.test.ts (new) uses ephemeral ports. The IPv6 cases skip only when the host has no IPv6 loopback. It covers:

• The default host serves both families on one port.
• All loopback Host/Origin headers are accepted over each family.
• An explicit IPv4 host, via the option or QMD_HOST, does not serve ::1.
• An IPv4 or IPv6 collision rejects and leaves nothing bound.
• stop() and close() release both families.

Results:

• RED: against the unchanged src/mcp/server.ts: 6 failed / 4 passed. IPv4 is refused.
• GREEN:
  • vitest: test/mcp-http-loopback.test.ts + test/mcp-origin-guard.test.ts, 46 passed.
  • bun test on the same files: 46 pass, 0 fail.
• Checks: test:types and lint are clean.

Found while maintaining a downstream fork.