test: harden MCP v2 upgrade boundaries

Summary

Follow-up to #176 after exercising the SDK v2 upgrade at raw HTTP, client, framework, CLI, and published-package boundaries.

• reject unexpected browser Origins and add an explicit allowedOriginHostnames list
• preserve Allow: POST on stateless 405 responses
• prevent synchronous and asynchronous onEvent failures from breaking requests or becoming unhandled rejections
• verify SDK 1.26 clients, SDK 2 legacy mode, and pinned 2026-07-28 mode against the same handler
• verify auth policies and concurrent auth isolation
• make the CLI support src/app, --no-install, and safe refusal to overwrite existing routes
• test the packed artifact, correct its CommonJS type declaration target, and ship the docs linked from the npm README

Defects found by the new tests

1. Cross-origin browser requests were accepted instead of returning 403.
2. Stateless GET and DELETE responses returned 405 without Allow: POST.
3. A throwing onEvent callback failed the MCP request; an async rejection became unhandled.
4. The CLI overwrote an existing route and could not be integration-tested without installing dependencies.
5. The published CommonJS types condition referenced the nonexistent dist/index.d.cjs file.
6. Documentation linked from the npm README was omitted from the tarball.

Validation

• pnpm test: 44 tests across 6 files
• pnpm exec tsc --noEmit --noUnusedLocals --noUnusedParameters
• git diff --check
• linked package in mcp-for-next.js: type check and production build pass
• MCP Inspector CLI against the linked Next.js app:
  • tools/list
  • valid tools/call with structured output
  • invalid tools/call returning isError
  • tools/call on a dynamic custom mount path

Release

Includes a patch changeset for mcp-handler 2.0.1.