Add ldk-server-mcp crate scaffolding for MCP gateway

v1 scaffolding for an HTTPS gateway that will expose the LDK Server gRPC
API as an MCP (Model Context Protocol) server, plus a small admin web UI
for minting scoped auth tokens to plug into Claude Desktop / Claude Code.

This PR adds the foundational pieces only:

- New `ldk-server-mcp` workspace crate with a TOML config, an `axum`-based
  HTTPS listener (HTTP/1.1 + HTTP/2 via `hyper-util`'s auto builder), and
  a `/healthz` endpoint
- Self-signed TLS cert auto-generation in `storage_dir`, mirroring the
  daemon's pattern in `ldk-server/src/util/tls.rs` (the daemon code is
  unchanged; the v2 plan extracts the shared bits into a util crate)
- A `DaemonClient` wrapper around `ldk-server-client` that loads the
  daemon's `api_key` and TLS cert from disk and verifies connectivity on
  boot via `GetNodeInfo`
- `GatewayLogger` matching the daemon's `ServerLogger` style so operators
  see consistent log output across the two processes
- Sample config in `contrib/ldk-server-mcp-config.toml` and a crate-level
  `README.md`
- Brainstorm doc at `docs/brainstorms/2026-05-07-ldk-server-mcp.md`
  capturing the full v1 spec and the suggested PR breakdown for the rest
  of the work (sqlite token store, web UI, MCP tool layer over the ~40
  RPCs, `SubscribeEvents` -> MCP notifications fan-out, Connect-to-Claude
  UX)

The daemon is unmodified. 14 unit tests cover config parsing, scheme
stripping, log-level validation, unknown-field rejection, the cert
generate/load roundtrip, and the `/healthz` route. `cargo fmt`, `cargo
clippy --all-targets -- -D warnings`, `cargo test`, `cargo check
--release`, and `cargo doc --release` all pass for the new crate.

This change was developed with Claude Code assistance.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: vincenzopalazzo

Cargo.lock

@@ -1,6 +1,6 @@
 [workspace]
 resolver = "2"
-members = ["ldk-server-cli", "ldk-server-client", "ldk-server-grpc", "ldk-server"]
+members = ["ldk-server-cli", "ldk-server-client", "ldk-server-grpc", "ldk-server", "ldk-server-mcp"]
 exclude = ["e2e-tests"]
 
 [profile.release]

Cargo.toml

@@ -0,0 +1,37 @@
+# LDK Server MCP gateway settings
+[gateway]
+# Address the gateway listens on for HTTPS (UI + future MCP endpoint).
+listen_addr = "127.0.0.1:3537"
+
+# Directory the gateway uses for persistent state. Holds tls.crt / tls.key
+# (auto-generated if not provided), the future sqlite token store, and the
+# bootstrap admin token hash.
+storage_dir = "/var/lib/ldk-server-mcp"
+
+# Optional. Defaults to "info". Accepts: error, warn, info, debug, trace, off.
+#log_level = "info"
+
+# Optional. Defaults to <storage_dir>/ldk-server-mcp.log.
+#log_file_path = "/var/log/ldk-server-mcp.log"
+
+# Optional TLS overrides. If both are omitted, a self-signed certificate is
+# auto-generated under storage_dir on first start (mirrors the daemon).
+#[gateway.tls]
+#cert_path = "/etc/ldk-server-mcp/tls.crt"
+#key_path  = "/etc/ldk-server-mcp/tls.key"
+# Extra hosts to include in the auto-generated certificate's SAN list. The
+# names "localhost" and "127.0.0.1" are always included.
+#hosts = ["mcp.example.com"]
+
+# Connection details for the upstream LDK Server daemon.
+[daemon]
+# Bare host:port; the scheme is stripped if present.
+address = "127.0.0.1:3536"
+
+# Path to the api_key file that the daemon writes on first start. Typically
+# under <daemon storage_dir>/<network>/api_key. Must be absolute.
+api_key_path = "/var/lib/ldk-server/bitcoin/api_key"
+
+# Path to the daemon's TLS certificate. Used to pin the daemon's self-signed
+# cert when the gateway connects to it. Must be absolute.
+tls_cert_path = "/var/lib/ldk-server/tls.crt"