Call classify_base_url on MCP server start

[jmjava]

Summary

• Q-SLM-20 leftover Refuse unsafe MCP payloads and attach local_review notes #10: server.main() now calls classify_base_url on the configured OLLAMA_BASE_URL and exits 1 on fail (wildcard, tunnel, public IP).
• Hostname and private LAN URLs still only warn (leftovers Expand eval corpus to 20 cases with stratified stats #11/Fail closed when scripted orchestrator apply triples mismatch #20 unchanged). Leftover Tighten local-to-premium review handoff #9 CI Deployment safety step is untouched. Leftover Add Halo host profile, C4 diagrams, and public roadmap #5 MAX_BYTES is not touched.
• No A8/A9, downstairs GPU, or Halo 4 work.

Test plan

• PYTHONPATH=src python -m unittest tests.test_server_runtime_safety -v
• Proving test: test_server_start_calls_classify_base_url
• Fail URL refuses start: test_server_start_refuses_fail_base_url
• Leftover Tighten local-to-premium review handoff #9 still present: test_leftover_9_ci_deployment_safety_step_stays and test_ci_deployment_safety_can_go_red
• Full unittest discover -s tests -v
• Wait for GitHub Actions unit job to go green

Made with Cursor