feat(serve): spawn HTTP server alongside MCP with graceful shutdown

Add HttpServeOpts struct and update run_serve to optionally spawn an
axum HTTP server as a tokio task before the blocking MCP stdio loop.
Uses CancellationToken for coordinated shutdown when MCP exits.
Validates --no-auth is only allowed on 127.0.0.1.

Author: devwhodevs

src/main.rs

@@ -1056,7 +1056,7 @@ async fn main() -> Result<()> {
                 eprintln!("No index found. Run 'engraph index <path>' first.");
                 std::process::exit(1);
             }
-            engraph::serve::run_serve(&data_dir).await?;
+            engraph::serve::run_serve(&data_dir, None).await?;
         }
 
         Command::Write { action } => {

src/serve.rs

@@ -730,11 +730,30 @@ impl rmcp::handler::server::ServerHandler for EngraphServer {
     }
 }
 
+// ---------------------------------------------------------------------------
+// HTTP server options (populated by CLI flags in Task 7)
+// ---------------------------------------------------------------------------
+
+pub struct HttpServeOpts {
+    pub port: u16,
+    pub host: String,
+    pub no_auth: bool,
+}
+
 // ---------------------------------------------------------------------------
 // Entry point
 // ---------------------------------------------------------------------------
 
-pub async fn run_serve(data_dir: &Path) -> Result<()> {
+pub async fn run_serve(data_dir: &Path, http_opts: Option<HttpServeOpts>) -> Result<()> {
+    if let Some(ref opts) = http_opts {
+        if opts.no_auth && opts.host != "127.0.0.1" {
+            anyhow::bail!(
+                "--no-auth cannot be used with --host {} (only 127.0.0.1 is allowed)",
+                opts.host
+            );
+        }
+    }
+
     let db_path = data_dir.join("engraph.db");
     let models_dir = data_dir.join("models");
 
@@ -800,6 +819,15 @@ pub async fn run_serve(data_dir: &Path) -> Result<()> {
     let profile_arc = Arc::new(profile);
     let recent_writes: RecentWrites = Arc::new(Mutex::new(HashMap::new()));
 
+    // Clone Arcs for HTTP server before MCP consumes them
+    let http_store = store_arc.clone();
+    let http_embedder = embedder_arc.clone();
+    let http_vault_path = vault_path_arc.clone();
+    let http_profile = profile_arc.clone();
+    let http_orchestrator = orchestrator.as_ref().map(Arc::clone);
+    let http_reranker = reranker.as_ref().map(Arc::clone);
+    let http_recent_writes = recent_writes.clone();
+
     // Start file watcher for real-time index updates
     let mut exclude = config.exclude.clone();
     if let Some(ref prof) = *profile_arc
@@ -831,12 +859,45 @@ pub async fn run_serve(data_dir: &Path) -> Result<()> {
         recent_writes,
     };
 
+    // Cancellation token for coordinated shutdown of HTTP + MCP
+    let cancel_token = tokio_util::sync::CancellationToken::new();
+
+    // Spawn HTTP server as a background task (before MCP blocks on stdio)
+    if let Some(ref opts) = http_opts {
+        let config = Config::load()?;
+        let api_state = crate::http::ApiState {
+            store: http_store,
+            embedder: http_embedder,
+            vault_path: http_vault_path,
+            profile: http_profile,
+            orchestrator: http_orchestrator,
+            reranker: http_reranker,
+            http_config: Arc::new(config.http.clone()),
+            no_auth: opts.no_auth,
+            recent_writes: http_recent_writes,
+            rate_limiter: Arc::new(crate::http::RateLimiter::new(config.http.rate_limit)),
+        };
+        let router = crate::http::build_router(api_state);
+        let addr = format!("{}:{}", opts.host, opts.port);
+        let listener = tokio::net::TcpListener::bind(&addr).await?;
+        let cancel = cancel_token.clone();
+        eprintln!("HTTP server listening on http://{}", addr);
+        tokio::spawn(async move {
+            axum::serve(listener, router)
+                .with_graceful_shutdown(cancel.cancelled_owned())
+                .await
+                .ok();
+        });
+    }
+
     eprintln!("engraph MCP server starting...");
 
     let transport = rmcp::transport::io::stdio();
     let server_handle = server.serve(transport).await?;
     server_handle.waiting().await?;
 
+    cancel_token.cancel(); // triggers HTTP graceful shutdown
+
     // Shut down watcher cleanly after MCP transport exits
     let _ = watcher_shutdown.send(());
     if let Err(e) = watcher_handle.join() {