fix(server): refuse unparsable allowed-hosts at startup

[plusky]

What

Hardens HTTP Host validation so a typo in --allowed-hosts / MCP_ALLOWED_HOSTS cannot silently brick a deployment.

• HTTP start emits one info line stating whether Host validation is on or off and, when on, the resolved list verbatim (Host validation: off / Host validation: on; allowed hosts: …).
• An entry that is not a hostname or host:port (*, a scheme-carrying URL, a;b, encoded commas, zero-width unicode, a space-containing typo) is a startup error, named in the message. rmcp 3.1.2 would otherwise keep validation on and store (or skip) a host no inbound Host matches — deny-all, one 403 at a time.
• Whitespace is no longer a list separator. a b.example stays one unparsable entry instead of becoming a single-label a plus b.example. Comma-separated lists still work; whitespace around commas is trimmed.
• MCP_ALLOWED_HOSTS= still reads as unset (validation off).
• allowed_origins is unchanged. DESIGN.md already records why it has no knob (inherited empty = off); that decision is not reopened.

Why

Three operator-hostile gaps from #104's review, all fail-closed: no startup visibility of the effective Host list, unparsable entries as a silent deny-all, and whitespace splitting manufacturing authorities from typos.

Invariants

• I9: naming hosts only ever turns validation on (tightening). Unparsable is fail-closed, not fail-open.
• I12: the startup line is hosts only; tests pin a canary key is absent from the capture.

Verification

cargo fmt --check
cargo clippy --workspace --all-targets -- -D warnings
cargo clippy -p bugwarden --features gen --all-targets -- -D warnings
cargo test --workspace --all-targets --locked
cargo deny check

Man page and completions regenerated (bugwarden-gen). Tests are mutation-proof: deleting the info line or the unparsable refusal fails config.rs / server.rs / env_config.rs / http_transport_wiremock.rs.

Adversarial review (checklist: silent deny-all, whitespace typo, empty-unset, I12, I9, mutation-proof tests) found no bugs.

Closes #117