fix: use shared DEFAULT_CORS_CONFIG in HTTP stream transport

[QuantGeekDev]

Summary

• Replaces hardcoded CORS fallback values in HttpStreamTransport.setCorsHeaders() with references to the shared DEFAULT_CORS_CONFIG from src/transports/sse/types.ts
• Previously, HTTP Stream defaulted to Content-Type, Authorization, Mcp-Session-Id while SSE included Accept, x-api-key, Last-Event-ID — this mismatch caused CORS preflight failures in Chrome
• Both transports now use identical default CORS headers

Test plan

• 5 new tests pass in tests/transports/http/cors-consistency.test.ts
• Test HTTP Stream transport with MCP Inspector in Chrome — no CORS errors
• Verify custom CORS config still overrides defaults

Closes #93

🤖 Generated with Claude Code