- Route MCP streamable handler to /mcp via http.ServeMux - Move /health to a dedicated mux route (no auth required) - Simplify authMiddleware by removing /health special case - Apply CORS middleware at the mux level - Ignore nix build result symlink