refactor(mcp): compose origin allowlist as middleware, remove duplication

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

cmd/gitea-mcp/main.go

@@ -23,13 +23,12 @@ func main() {
 	// Tool registration happens in Phase 6+; for now, registry is empty.
 
 	mcpSrv := mcp.NewServer(mcp.ServerOptions{
-		Registry:        reg,
-		OriginAllowlist: cfg.OriginAllowlist,
-		Sessions:        mcp.NewSessionStore(),
+		Registry: reg,
+		Sessions: mcp.NewSessionStore(),
 	})
 
 	mux := http.NewServeMux()
-	mux.Handle("/mcp", mcpSrv)
+	mux.Handle("/mcp", mcp.OriginAllowlist(cfg.OriginAllowlist)(mcpSrv))
 	mux.HandleFunc("/healthz", func(w http.ResponseWriter, _ *http.Request) {
 		w.WriteHeader(http.StatusOK)
 		_, _ = w.Write([]byte("ok"))