feat: embedded NATS with VeraeTime handlers and stdio MCP

Start in-process nats-server on VERAE_NATS_LISTEN (default 127.0.0.1:4223;
empty disables). Queue-subscribe verae.ts.request|verify|hash.report with
ledger/veraetime routing and authctx.Resolve from authorization/access_token.
Publish verae.ts.completed on core NATS only (no JetStream). Wire embed into
main alongside Streamable HTTP; stdio MCP via go-sdk StdioTransport.

cmd/verae-mcp-timestamping-server/main.go

@@ -10,6 +10,7 @@ import (
 	"os/signal"
 	"syscall"
 
+	"git.georgelambert.org/marchon/verae-mcp-timestamping-server-go/internal/embednats"
 	"git.georgelambert.org/marchon/verae-mcp-timestamping-server-go/internal/ledger"
 	"git.georgelambert.org/marchon/verae-mcp-timestamping-server-go/internal/server"
 	"git.georgelambert.org/marchon/verae-mcp-timestamping-server-go/internal/tools"
@@ -32,6 +33,21 @@ func main() {
 	global := veraetime.NewClient(cfg.GlobalURL, veraetime.WithAuthPath(cfg.AuthPath))
 	keeper := veraetime.NewKeeper(global, cfg.AuthPath)
 
+	emb, err := embednats.Start(embednats.Options{
+		Listen:        cfg.NATSListen,
+		Ledger:        led,
+		Global:        global,
+		Keeper:        keeper,
+		RequireBearer: cfg.RequireBearer,
+	})
+	if err != nil {
+		log.Fatalf("embednats: %v", err)
+	}
+	if emb != nil {
+		defer emb.Shutdown()
+		log.Printf("embedded NATS listening on %s", emb.ClientURL())
+	}
+
 	switch cfg.Transport {
 	case "streamable-http", "http":
 		srv, err := server.New(server.Options{