test+fix: address principal-engineer review findings (Phases 0-4)

[lakhansamani]

Stacked on top of #617 (which is stacked on #616 → #615 → #614). Review and merge after Phase 4.

Summary

Adds the missing integration/e2e test coverage flagged across reviews of #614 / #615 / #616 / #617, and fixes the blocking bugs those reviews surfaced. Test additions are spread across every layer the PR stack introduces; fixes are deliberately scoped to issues that would have hit production on the first deploy.

New tests (8 files, ~50 sub-cases)

File	Coverage
`internal/parsers/url_test.go`	`GetHostFromRequest` priority + spoof rejection; `GetAppURLFromRequest`
`internal/cookie/cookie_test.go`	`BuildSessionCookies`/`BuildMfaSessionCookies` shape, MaxAge, Secure, HttpOnly, SameSite; `ParseSameSite`
`internal/service/sideeffects_test.go`	`MetaFromGin`/`ApplyToGin` nil-safety + cookie round-trip
`internal/grpcsrv/interceptors/interceptors_test.go`	Recovery (panic→Internal), Logging (per-code level), Validate (protovalidate)
`internal/grpcsrv/transport/grpc_metadata_test.go`	`MetaFromGRPC` host/IP/UA/auth/cookies + `:authority` fallback
`internal/mcp/schema_test.go`	Flat scalars, nested message, cycle-safety regression test for AppData→Struct→Value
`internal/integration_tests/grpc_surface_test.go`	All 18 stub RPCs verified to return `codes.Unimplemented` + gRPC health endpoint
`internal/integration_tests/rest_openapi_test.go`	`/openapi.json` serves valid swagger 2.0
`internal/integration_tests/mcp_stubs_test.go`	MCP stubbed-tool call returns `CallToolResult{IsError:true}`

Blocking fixes from review

#	Where	Fix
#616-1	`cmd/root.go`	--grpc-port default 8081 collided with --metrics-port. Moved gRPC to 9091. Added triple-port collision check (HTTP/metrics/gRPC); fails fast at startup.
#616-2	`internal/grpcsrv/transport/grpc_metadata.go`	`MetaFromGRPC` now extracts cookies from `grpcgateway-cookie` / `cookie` metadata. Without this fix, every authenticated flow would break the moment SessionService stubs became real handlers.
#616-3	same file	`ApplyToGRPC` now emits all Set-Cookie metadata entries (was dropping all but first).
#616-4	`internal/server/http_routes.go` + new `gen/openapi/openapi.go`	`/openapi.json` was reading via relative path (broke in Docker/tests). Now embedded via `//go:embed`.
#617-1	`internal/mcp/schema.go`	`schemaForMessage` tracks visited descriptors. Without this, exposing any tool whose request contained `google.protobuf.Value` (e.g. AppData→Struct→Value→repeated Value) would stack-overflow at boot.
#617-2	`internal/mcp/server.go`	Tool execution errors now surface as `CallToolResult{IsError:true}` (MCP-spec way) instead of opaque JSON-RPC failures.
#617-3	`internal/mcp/scanner.go`	Removed unused `descriptorOptionsCarrier` dead-code struct + always-failing type assertion.

Deliberately deferred (tracked but not in this PR)

• `--grpc-tls-cert/-key/-insecure` placeholders — flagged by reviewer; deferred to a focused TLS PR alongside the metrics-listener TLS work.
• Secrets in REST path (`DELETE /v1/refresh-tokens/{token}` etc.) — flagged by reviewer; moving to body-borne tokens is a proto-design change worth its own PR + discussion.
• MCP auth metadata propagation — flagged by reviewer; today's MCP-exposed tools are `GetMeta` (no auth) + 3 stubs. Real wiring lands when the stubs become real handlers.

Test plan

• Full `go test ./...` green (17 packages, 69s integration suite)
• `go build ./...` clean
• CI green on this stacked PR

🤖 Generated with Claude Code

[lakhansamani]

Superseded by #620, which consolidates this stack into a single PR against main. All blocking review findings from this PR were addressed in #620; see its body for the per-finding traceback.