HTTP server with CORS enabled for PenPot plugin development. This allows PenPot to load the plugin from localhost. self.send_header('Access-Control-Allow-Origin ...

* CORS + `_meta.ui.resourceUri` injection for the portfolio MCP endpoint. * Two concerns folded into one class since both operate on the REST * response pipeline for the same route scope.