fix(deps): bump mcp to 1.28.1 to clear 3 high-severity CVEs (headroomlabs-ai#2348)

## Description

Clears **all 3 open Dependabot alerts** (and the `pip-audit` CI failure)
— every one is `mcp 1.26.0` in `uv.lock`:

| Alert | CVE | Issue | Fix |
|-------|-----|-------|-----|
| headroomlabs-ai#155 | CVE-2026-52870 | experimental task handlers leak cross-session
tasks | 1.27.2 |
| headroomlabs-ai#156 | CVE-2026-52869 | HTTP transports serve session requests without
auth check | 1.27.2 |
| headroomlabs-ai#157 | CVE-2026-59950 | deprecated WebSocket transport lacks
Host/Origin validation | 1.28.1 |

`mcp 1.28.1` satisfies all three.

Closes #

## Type of Change
- [x] Bug fix (security / dependency)

## Changes Made
- `pyproject.toml`: raise the floor `mcp>=1.0.0` → `mcp>=1.28.1` (core
dep **and** the `[mcp]` extra).
- `uv.lock`: bump the `mcp` entry `1.26.0` → `1.28.1` (version +
sdist/wheel URL, sha256, size from PyPI).

**Surgical on purpose.** mcp 1.28.1's resolved dependency set is
unchanged for this project's Python range (1.26 vs 1.28.1 differ only in
`python_version>=3.14` conditionals and an httpx upper bound already
satisfied), so no other locked package changes. Verified: `uv.lock`
parses, `mcp = 1.28.1`, no `mcp-1.26.0` refs remain.

## Testing
```text
python -c "import tomllib; ...; print(pkgs['mcp'])"  -> 1.28.1   (uv.lock valid TOML)
git diff --stat                                       -> pyproject.toml | 4 ; uv.lock | 6
grep -c mcp-1.26.0 uv.lock                            -> 0
```
mcp 1.28.1 ≥ every advisory's fixed-version, so all 3 alerts + pip-audit
clear.

## Real Behavior Proof
- Env: local; hashes fetched from
`https://pypi.org/pypi/mcp/1.28.1/json`.
- Steps: bumped the pyproject floor + the single mcp lock entry;
validated TOML + version + absence of old refs.
- Not tested: full `uv sync` (the lock is separately stale — see note).

## Note (deliberate scoping)
A full `uv lock` refresh churns ~900 lines: the lock is **separately
stale** (missing some declared deps) and local `uv` resolution diverges
(major downgrades of protobuf/posthog/portalocker — likely an env
artifact). That's a pre-existing lock-hygiene problem for its own PR —
**not** bundled into this security fix. No `CHANGELOG.md` edit
(release-please owns it).

Author: chopratejas

pyproject.toml

@@ -73,7 +73,7 @@ proxy = [
     "orjson>=3.9.14; platform_python_implementation != 'PyPy'",
     "httpx[http2]>=0.24.0",
     "openai>=2.14.0",             # OpenAI API format support
-    "mcp>=1.0.0",                 # MCP server (headroom_compress, retrieve, stats)
+    "mcp>=1.28.1",                 # MCP server (headroom_compress, retrieve, stats)
     "magika>=0.6.0",              # ML content detection for ContentRouter
     "zstandard>=0.20.0",          # Decompress zstd request bodies (Codex, etc.)
     "websockets>=13.0",           # WebSocket proxy for /v1/responses (Codex gpt-5.4+)
@@ -220,7 +220,7 @@ autogen = [
 ]
 # MCP server for Claude Code integration
 mcp = [
-    "mcp>=1.0.0",
+    "mcp>=1.28.1",
     "httpx>=0.24.0",
     "starlette>=0.27.0",
     "uvicorn>=0.23.0,<1.0",