Migrate HTTP server to mcdsl/httpserver

Replace manual chi/TLS/http.Server setup with httpserver.New which
provides TLS 1.3, config-driven timeouts, and the chi router. Replace
local loggingMiddleware and statusWriter with mcdsl equivalents.

Seal-aware middleware (requireUnseal, requireAuth, requireAdmin) and
token extraction remain metacrypt-specific.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

internal/server/middleware.go

@@ -4,7 +4,6 @@ import (
 	"context"
 	"net/http"
 	"strings"
-	"time"
 
 	"git.wntrmute.dev/kyle/metacrypt/internal/auth"
 	"git.wntrmute.dev/kyle/metacrypt/internal/seal"
@@ -20,22 +19,6 @@ func TokenInfoFromContext(ctx context.Context) *auth.TokenInfo {
 	return info
 }
 
-// loggingMiddleware logs HTTP requests, stripping sensitive headers.
-func (s *Server) loggingMiddleware(next http.Handler) http.Handler {
-	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		start := time.Now()
-		sw := &statusWriter{ResponseWriter: w, status: 200}
-		next.ServeHTTP(sw, r)
-		s.logger.Info("http request",
-			"method", r.Method,
-			"path", r.URL.Path,
-			"status", sw.status,
-			"duration", time.Since(start),
-			"remote", r.RemoteAddr,
-		)
-	})
-}
-
 // requireUnseal rejects requests unless the service is unsealed.
 func (s *Server) requireUnseal(next http.HandlerFunc) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
@@ -105,12 +88,3 @@ func extractToken(r *http.Request) string {
 	return ""
 }
 
-type statusWriter struct {
-	http.ResponseWriter
-	status int
-}
-
-func (w *statusWriter) WriteHeader(code int) {
-	w.status = code
-	w.ResponseWriter.WriteHeader(code)
-}