add support for custom HTTP headers

[igrigorik]

Adds generic --header 'Name: Value' flag (repeatable) and a
per-profile persistent file ~/.ucp/profiles/<name>/headers.json with
default + businesses[<origin>] sections — shape mirrors git's
[http] / [http "<URL>"]. Seed a built-in
User-Agent: @shopify/ucp-cli/<version> at lowest priority on every
outbound fetch (mcp-client + cache), overridable from every other source.

Four-source merge, higher wins on case-insensitive header-name conflict:
built-in → config.default → config.businesses[origin] → --header.
Non-conflicting headers from every source ship.

Reserved framing headers (Content-Type, Accept, Host, hop-by-hop,
MCP-Protocol-Version) are silently dropped from user sources. Sensitive
values (Authorization, Cookie, suffix -Token / -Key / -Secret /
-Password) are redacted in verbose traces.

[TateLyman]

Reviewed the custom-header flow in this PR. The resolver/merge/redaction layer looks solid, and operation dispatch plus --input-schema both forward the resolved headers through discovery and MCP calls.

One gap I noticed: the top-level ucp discover command does not get the new header path. Its option schema currently has business, profile, profileUrl, refresh, and view, but no header; then the command calls:

const discoverResult = await discoverImpl(businessUrl, {
  force: c.options.refresh,
  profileUrl: requireProfileUrl(session.profile.profileUrl),
})

So a merchant that requires auth/tenant headers even for /.well-known/ucp or tools/list can be used via catalog/cart/checkout ... --header ... and via --input-schema, but cannot be introspected with the natural first command:

ucp discover --business https://merchant.example --header "Authorization: Bearer $TOKEN"

That seems like the one place where the feature promise and CLI surface diverge. Suggested fix: add the same repeatable header option to the discover command, resolve with the session profile + canonical business origin, and pass headers into discoverImpl. A regression test could stub discover and assert the second arg includes { headers: { Authorization: "Bearer token" } } for ucp discover --business ... --header ....

I did not test against private merchants or send credentials; this is just a static review of the public PR diff.

[igrigorik]

@TateLyman great catch sir, ty! Fixed and centralized the logic so we have a unified path.