fix: disable localhost Host protection behind Caddy

Public MCP requests arrive with Host mcp.verae.ai while the process binds
127.0.0.1; the go-sdk default rejected those with 403.

internal/server/server.go

@@ -67,11 +67,14 @@ func New(opts Options) (*Server, error) {
 		RequireBearer: opts.RequireBearer,
 	}
 	mcpServer := tools.NewServer(deps)
+	// Behind Caddy (or any reverse proxy) the bind is loopback while Host is
+	// the public name (mcp.verae.ai). Disable the SDK's localhost Host check.
 	stream := mcp.NewStreamableHTTPHandler(func(*http.Request) *mcp.Server {
 		return mcpServer
 	}, &mcp.StreamableHTTPOptions{
-		JSONResponse: opts.JSONResponse,
-		Stateless:    opts.Stateless,
+		JSONResponse:               opts.JSONResponse,
+		Stateless:                  opts.Stateless,
+		DisableLocalhostProtection: true,
 	})
 
 	mux := http.NewServeMux()