Widens visibility from pub(crate) to pub so tests/mcp_server_test.rs (an external integration-test crate, per CLAUDE.md's "cross-service tests in /tests") can drive the real HTTP transport end-to-end. This does not weaken the loopback guarantee: bind_loopback still refuses non-loopback regardless of caller -- only its visibility changed.