feat(mcp-server): serve the canvas shell at /shell/ behind DRAWIO_PREVIEW_UI

GET /shell/ fills the page template's {{CONFIG_JSON}} with the session,
the API token, where draw.io comes from and the host's editor settings,
with the classic page's security headers; /shell/<file> serves the built
files like the draw.io copy. start_session opens the shell when
DRAWIO_PREVIEW_UI=shell; the classic page stays the default.

packages/mcp-server/src/index.ts

@@ -57,6 +57,7 @@ import {
     keepInHistory,
     onSessionRecreate,
     onStateChange,
+    previewUrl,
     requestExport,
     requestSync,
     restoreHistoryEntry,
@@ -382,7 +383,7 @@ registerWriteTool(
             }
 
             // Open browser
-            const browserUrl = `http://localhost:${port}?mcp=${sessionId}`
+            const browserUrl = previewUrl(port, sessionId)
             await open(browserUrl)
 
             // A saved diagram comes back from its file. lastSeenXml stays