Add MCP HTTP proxy mode

[Lauritz-Timm]

Summary

Add a lightweight MCP stdio proxy so multiple clients can share one warm ICM HTTP daemon.

Motivation

Each stdio client currently launches a separate icm serve process and may load its own embedding model. Memory use therefore scales with the number of connected clients.

Changes

• add icm serve --http-proxy <URL>
• forward MCP stdio traffic to a shared local HTTP daemon
• expose POST /mcp on the warm daemon
• document the multi-client setup and memory tradeoff

Compatibility and safety

Existing stdio and HTTP modes are unchanged. The proxy is opt-in and does not change the MCP request or response contract.

Validation

cargo check -p icm-cli --no-default-features --features http-api,backend-sqlite
cargo test -p icm-cli --bin icm proxy --no-default-features --features http-api,backend-sqlite,embeddings
cargo test -p icm-mcp --no-default-features --features backend-sqlite

[pszymkowiak]

I tested this end-to-end (checked the branch out, built with the default http-api feature, and drove the real flow) — the proxy works:

• Started icm serve --http 127.0.0.1:PORT (daemon) + icm serve --http-proxy http://127.0.0.1:PORT (proxy).
• Piped MCP JSON-RPC (initialize + icm_memory_store + icm_memory_recall) into the proxy → got valid MCP responses back, no proxy stderr.
• Confirmed the stored memory actually landed in the daemon's DB (verified with a recall after stopping the daemon). So the stdio→HTTP→shared-store round-trip is correct.

Build clean, cargo clippy clean, existing suite green (292 passed). Nice, focused solution to #314 (one warm daemon + lightweight stdio proxies instead of N model loads).

Two things needed before it can merge:

1. Rebase onto current develop — this branch is ~15 commits behind and touches crates/icm-mcp/src/server.rs and crates/icm-cli/src/main.rs, both of which changed since (e.g. run_server gained an AutoConsolidate param in #318/#329; main.rs got the doctor/repair early-dispatch, hook disable, read-only/maintenance openers). It will conflict as-is. (serverInfo.version in my run showed 0.10.34, confirming the old base.)
2. Add tests — the PR currently adds none. At minimum: mcp_proxy_endpoint URL building (with/without compact, trailing slash, token), and an integration test that spins up the daemon + proxies one tools/call through it. The feature is exactly the kind that regresses silently without a test.

Happy to re-review once it's rebased with tests — the core behavior is verified working.