Harden the HTTP transport: health endpoint, CORS, resumption

[danielkov]

Health endpoint and CORS are disabled on both routers in src/protocols/http.rs. Enable them behind configuration. Track the Active streamable-HTTP RFD for v2 reconnection and Last-Event-ID resumption semantics.

Part of #146.