Switch gRPC admin API to Unix socket only, add client package

- Remove TCP listener support from gRPC server; Unix socket is now the
  only transport for the admin API (access controlled via filesystem
  permissions)
- Add standard gRPC health check service (grpc.health.v1.Health)
- Implement MCPROXY_* environment variable overrides for config
- Create client/mcproxy package with full API coverage and tests
- Update ARCHITECTURE.md and dev config (srv/mc-proxy.toml)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

internal/config/config_test.go

@@ -195,26 +195,23 @@ addr = ":8443"
 	}
 }
 
-func TestGRPCIsUnixSocket(t *testing.T) {
+func TestGRPCSocketPath(t *testing.T) {
 	tests := []struct {
 		addr string
-		want bool
+		want string
 	}{
-		{"/var/run/mc-proxy.sock", true},
-		{"unix:/var/run/mc-proxy.sock", true},
-		{"127.0.0.1:9090", false},
-		{":9090", false},
-		{"", false},
+		{"/var/run/mc-proxy.sock", "/var/run/mc-proxy.sock"},
+		{"unix:/var/run/mc-proxy.sock", "/var/run/mc-proxy.sock"},
 	}
 	for _, tt := range tests {
 		g := GRPC{Addr: tt.addr}
-		if got := g.IsUnixSocket(); got != tt.want {
-			t.Fatalf("IsUnixSocket(%q) = %v, want %v", tt.addr, got, tt.want)
+		if got := g.SocketPath(); got != tt.want {
+			t.Fatalf("SocketPath(%q) = %q, want %q", tt.addr, got, tt.want)
 		}
 	}
 }
 
-func TestValidateGRPCUnixNoTLS(t *testing.T) {
+func TestValidateGRPCUnixSocket(t *testing.T) {
 	dir := t.TempDir()
 	path := filepath.Join(dir, "test.toml")
 
@@ -231,11 +228,11 @@ addr = "/var/run/mc-proxy.sock"
 
 	_, err := Load(path)
 	if err != nil {
-		t.Fatalf("expected Unix socket without TLS to be valid, got: %v", err)
+		t.Fatalf("expected Unix socket to be valid, got: %v", err)
 	}
 }
 
-func TestValidateGRPCTCPRequiresTLS(t *testing.T) {
+func TestValidateGRPCRejectsTCPAddr(t *testing.T) {
 	dir := t.TempDir()
 	path := filepath.Join(dir, "test.toml")
 
@@ -252,7 +249,7 @@ addr = "127.0.0.1:9090"
 
 	_, err := Load(path)
 	if err == nil {
-		t.Fatal("expected error for TCP gRPC addr without TLS certs")
+		t.Fatal("expected error for TCP gRPC addr")
 	}
 }
 
@@ -311,3 +308,86 @@ func TestDuration(t *testing.T) {
 		t.Fatalf("got %v, want 5s", d.Duration)
 	}
 }
+
+func TestEnvOverrides(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "test.toml")
+
+	data := `
+[database]
+path = "/tmp/test.db"
+
+[proxy]
+idle_timeout = "60s"
+
+[log]
+level = "info"
+`
+	if err := os.WriteFile(path, []byte(data), 0600); err != nil {
+		t.Fatalf("write config: %v", err)
+	}
+
+	// Set env overrides.
+	t.Setenv("MCPROXY_LOG_LEVEL", "debug")
+	t.Setenv("MCPROXY_PROXY_IDLE_TIMEOUT", "600s")
+	t.Setenv("MCPROXY_DATABASE_PATH", "/override/test.db")
+
+	cfg, err := Load(path)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	if cfg.Log.Level != "debug" {
+		t.Fatalf("got log.level %q, want %q", cfg.Log.Level, "debug")
+	}
+	if cfg.Proxy.IdleTimeout.Duration.Seconds() != 600 {
+		t.Fatalf("got idle_timeout %v, want 600s", cfg.Proxy.IdleTimeout.Duration)
+	}
+	if cfg.Database.Path != "/override/test.db" {
+		t.Fatalf("got database.path %q, want %q", cfg.Database.Path, "/override/test.db")
+	}
+}
+
+func TestEnvOverrideInvalidDuration(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "test.toml")
+
+	data := `
+[database]
+path = "/tmp/test.db"
+`
+	if err := os.WriteFile(path, []byte(data), 0600); err != nil {
+		t.Fatalf("write config: %v", err)
+	}
+
+	t.Setenv("MCPROXY_PROXY_IDLE_TIMEOUT", "not-a-duration")
+
+	_, err := Load(path)
+	if err == nil {
+		t.Fatal("expected error for invalid duration")
+	}
+}
+
+func TestEnvOverrideGRPCAddr(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "test.toml")
+
+	data := `
+[database]
+path = "/tmp/test.db"
+`
+	if err := os.WriteFile(path, []byte(data), 0600); err != nil {
+		t.Fatalf("write config: %v", err)
+	}
+
+	t.Setenv("MCPROXY_GRPC_ADDR", "/var/run/override.sock")
+
+	cfg, err := Load(path)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	if cfg.GRPC.Addr != "/var/run/override.sock" {
+		t.Fatalf("got grpc.addr %q, want %q", cfg.GRPC.Addr, "/var/run/override.sock")
+	}
+}