Add observe serve HTTP endpoint for VPS info

[pol-cova]

Summary

Adds observe serve, a read-only HTTP server that exposes the same JSON snapshot as observe snapshot. This lets any frontend fetch live VPS metrics with a simple fetch() call.

Changes

• New observe serve subcommand with flags:
  • --port (default 8080) — override the listen port
  • --auto-port (default true) — if the requested port is busy, try the next available port
  • --bind (default 127.0.0.1)
  • --token (optional bearer auth)
  • --path (default /info)
  • --cors (default *)
• New internal/server package with CORS, OPTIONS preflight, and token auth
• Tests for JSON response, CORS headers, auth, method validation, and port fallback
• README section with usage and HTML fetch example

Usage

# Local only; auto-picks 8081 if 8080 is busy
observe serve

# Override port with auto fallback
observe serve --port 8080

# Require exact port (fail if busy)
observe serve --port 9000 --auto-port=false

# Public with auth
observe serve --bind 0.0.0.0 --port 8080 --token "your-secret"

fetch("http://your-vps:8080/info", {
  headers: { Authorization: "Bearer your-secret" }
}).then(r => r.json())

Security

• Binds to 127.0.0.1 by default
• Warns when binding to 0.0.0.0 without a token
• Read-only GET endpoint only

Test plan

• go test ./...
• go vet ./...
• go build