#759 Deploy: Highway MCP server public at https://mcp.highway.rodmena.app (multi-tenant)

Published the Highway MCP server as a public, multi-tenant HTTPS endpoint. (1) DNS: mcp.highway.rodmena.app A 93.89.141.229 (rodmena.app on Google Domains; added by user). (2) Per-request auth (server.py): each caller's hw_k1_ key read from the Authorization header via ctx.request_context.request; tenant derived from key; env HIGHWAY_API_KEY is the stdio fallback. Bound http transport to 127.0.0.1 + TransportSecuritySettings allow the public Host (nginx is the host boundary). (3) Info page web/index.html (endpoint, client config, key instructions). (4) systemd highway-mcp.service (Type=simple, farshid, TRANSPORT=http PORT=8848 HOST=127.0.0.1 HIGHWAY_BASE_URL=http://localhost:7822, Restart=always) - restart on change via 'systemctl restart highway-mcp'. (5) nginx /etc/nginx/conf.d/mcp.highway.rodmena.app.conf (page at /, /mcp -> 127.0.0.1:8848 with proxy_buffering off for SSE). (6) TLS via /opt/certbot/bin/certbot --nginx (Let's Encrypt, expires 2026-09-19, auto-renew). VALIDATED over https://mcp.highway.rodmena.app/mcp: initialize 200 + session id; per-request auth good-key OK (demo tenant)/bad-key 401/no-key clear error; full run_goal + HITL approve -> completed. Deploy units committed to rodmena-limited/highway-mcp (9c48b6d). Users connect by adding the URL + 'Authorization: Bearer hw_k1_<key>' header in their MCP client; no tenant id needed. FOLLOW-UP: rate-limiting/abuse (nginx limit_req or per-key quota); key minting UX in the dashboard.