perf(api): share cached artifact loading between web and MCP

[JSONbored]

Summary

The web app content loader and MCP route both implement static artifact loading behavior. A shared bounded artifact loader would reduce duplicated IO/cache logic, simplify tests, and make web/API/MCP behavior more consistent.

Current state

• apps/web/src/lib/content.ts has local/Cloudflare asset loading helpers and React cache wrappers.
• apps/web/src/app/api/mcp/route.ts has a separate local/asset artifact loading path for MCP.
• packages/mcp/src/registry.js can also read local artifacts by data dir or injected functions.

Desired behavior

• Create a shared artifact reader boundary for web API routes and MCP route handlers.
• Preserve local dev and Cloudflare Worker asset behavior.
• Keep bounded caching and safe path checks centralized.

Implementation notes

• Avoid pulling Next/server-only code into the published MCP package.
• The shared helper likely belongs in web lib code used by web routes, while the MCP package keeps injection-based artifact reads.
• Keep cache invalidation simple because artifacts are deployment-static.

Acceptance criteria

• Web API and MCP route use the same artifact read helper where appropriate.
• Safe path validation remains enforced.
• Local dev and Cloudflare asset fallback both work.
• Tests cover missing artifact, malformed JSON, local file, and injected/asset behavior.

Validation

• pnpm exec vitest run tests/mcp-http-route.test.ts tests/http-cache.test.ts tests/api-contracts.test.ts
• pnpm build
• Add or update focused unit tests for the touched API/helper surface.
• Run the narrow relevant validation command for the changed package or route.
• Run git diff --check before opening a PR.