v2.2.0 — serve MCP over HTTPS

vmware-monitor mcp can now serve the network as well as stdio (HLD §16, via vmware-policy 1.21.0):

vmware-audit token create alice          # once per caller; shown once
vmware-monitor mcp --transport https --host 0.0.0.0 --port 8443 \
    --cert server.pem --key server-key.pem --public-name mcp.example.com

Connect a client and manage callers (Claude Code shown; any MCP client with streamable HTTP and custom headers works):

claude mcp add --transport http vmware-monitor https://mcp.example.com:8443/mcp \
    --header "Authorization: Bearer $VMWARE_MCP_TOKEN"
vmware-audit token list                  # names only
vmware-audit token revoke alice          # refused from its next request, no restart

• Every request needs Authorization: Bearer <token>; the server will not start without a token, refuses Host or
  Origin values outside --public-name, and checks itself (unauthenticated requests must get 401) before it
  binds. --transport http binds loopback only, for a TLS-terminating reverse proxy.
• Audit rows record the caller as token:<name> and the surface as mcp-https. Calls naming different targets
  run in parallel; calls naming no target run one at a time.
• stdio remains the default; the vmware-monitor-mcp console script and python -m are unchanged.
• Everyone who can reach the endpoint acts with this server's account; run one endpoint per privilege level.
• Requires vmware-policy>=1.21.0 and mcp>=1.28.