fix(cli): remove unnecessary cors headers from mcp endpoint

[bpamiri]

Summary

• Remove static CORS headers (Access-Control-Allow-Origin, Allow-Methods, Allow-Headers) from the MCP endpoint — they are redundant since the endpoint is already restricted to localhost via cgi.REMOTE_ADDR check
• Change OPTIONS handler from 200 OK (CORS preflight) to 405 Method Not Allowed since CORS is no longer supported

Test plan

• Verify CORS headers no longer appear on MCP responses
• Verify OPTIONS requests return 405 with JSON error body
• Run full test suite (2661 pass, 6 pre-existing failures unrelated to this change)

🤖 Generated with Claude Code