New arc-mcp-http entry point runs the server over streamable-HTTP on a
loopback bind (ARC_MCP_HOST/PORT, default 127.0.0.1:8791). Optional
app-level bearer check (ARC_MCP_BEARER_TOKEN, constant-time) as
defense-in-depth; nginx/proxy enforces TLS + auth in production. stdio
default untouched so Claude Code + .mcp.json are unaffected. Self-deploy
runbook now carries concrete systemd + nginx templates. 54 tests pass.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>