Validate mcp.issuer is a full origin (with scheme) at config load #139

mcp.issuer is currently only checked for presence (src/index.ts updateConfiguration throws when mcp.enabled && !mcp.issuer). A schemeless or malformed value (e.g. as.example.com with no https://) passes that check but produces malformed/unsafe values downstream: resolveIssuer returns it verbatim, and resolveResource / protectedResourceMetadataUrl then either throw (new URL(...)) or fall back to non-fetchable strings.

Validate at config load that mcp.issuer parses as an absolute http(s) origin and fail fast with a clear error otherwise — turning a documented "pin the issuer to a full origin in production" convention into an enforced invariant.

Low priority / hardening. Surfaced by the cross-model review on #133/#134 (the schemeless-issuer edge behind the WWW-Authenticate header-safety fix).