toolchain router.
  /mcp           — reverse-proxy to the caller's pod
  /session/reset — recycle the caller's pod (reset_pod tool, authed)
  /healthz       — liveness