server: restore HTTP API — migrate to std.Io.net + std.http.Server v2

From fleet code review 2026-06-01 (`incomplete-undefined`, CRITICAL).
`codescan serve` had been returning `error.HttpServerNotMigrated` ever
since the Zig 0.15→0.16 port; the placeholder commit added a graceful
stderr message but the server was still dead.

This commit replaces the placeholder with a real listen-accept-dispatch
loop:

- `address.listen(io, .{ .reuse_address = true })` per the 0.16
  `std.Io.net.IpAddress` API; deferred close of the listening socket
- accept loop with logged-and-continue on per-connection errors
  (so a malformed request doesn't kill the server)
- per-connection 16 KB header + 16 KB write buffer (enough for typical
  requests; clients sending oversized heads get
  `error.HttpHeadersOversize`)
- `std.http.Server.init(&reader.interface, &writer.interface)` for the
  v2 io-aware HTTP frontend
- `receiveHead` → existing `handleRequest(allocator, &req, db,
  embedder, settings)` (which was already written against the v2
  Request API)
- handler errors logged with the request target; best-effort 500
  response if nothing was sent yet

Smoke-tested end-to-end against the codescan repo's own index:
  GET  /health  → 200 `{"status":"ok"}`
  GET  /status  → 200 (full index JSON: 101 files, 6402 symbols)
  GET  /help    → 200 (API docs)
  POST /search  → 200 (lexical hits, correct ranking)

PLAN.md: both HTTP server items checked off (Phase 4 + Phase 5b).
All 51 test binaries still pass.

Author: pmarreck

PLAN.md

@@ -32,7 +32,7 @@
 - [x] Define plugin interface + registry
 - [x] Implement Zig extractor (function spans + comments)
 - [x] Implement Elixir extractor (function spans + comments)
-- [ ] Restore HTTP server + endpoints (index/update/search/health) — code exists in `src/server.zig` but `serve()` returns `error.HttpServerNotMigrated` after the Zig 0.16 port; needs migration to `std.Io.net.IpAddress.listen` + `std.http.Server` v2. CLI surface advertises the command and now prints a clear redirect to `codescan search` / `codescan mcp-serve` until this lands. (Was checked in error — code shipped but never re-implemented after 0.16 port.)
+- [x] Restore HTTP server + endpoints (index/update/search/health) — DONE 2026-06-01. `server.serve()` now uses `std.Io.net.IpAddress.listen` + `std.http.Server` v2 (io-aware) per Zig 0.16. Accept-loop dispatches each connection through `handleRequest`, with per-connection 16 KB header/write buffers. Smoke-tested: `GET /health`, `GET /status`, `GET /help`, `POST /search` all return 200 with correct JSON/text from the codescan repo's own index.
 - [x] Add JSON output + human output formatting
 - [x] Wire main CLI (config merge, commands, .codescan setup)
 - [x] Add hybrid weight knobs (CLI/config/HTTP) + tests
@@ -140,7 +140,7 @@ Captured from the 9 dimension review notes in `inbox/`. Items that landed in thi
 - [ ] Decompose `fn search` (`src/search.zig` lines 94-406, 312 lines) — extract `runLexicalOnly`, `runVectorOnly`, `runHybrid` private fns; public `search` becomes ~30-line dispatcher. Each phase becomes independently testable. Reviewer: `disorganized` (WARN).
 - [ ] Extract stderr-writer boilerplate helper — pattern `var stderr_buf: [4096]u8 = undefined; var stderr_writer = std.Io.File.stderr().writer(io_singleton.getOrInit(), &stderr_buf); const stderr = &stderr_writer.interface;` appears in main.zig at lines 137, 159, 189, 212 and dozens elsewhere. Define `pub const STDERR_BUF_SIZE = 4096;` once and a `withStderr(comptime cb)` or `stderrWriter()` helper. Reviewer: `disorganized` (WARN).
 - [ ] Windows watcher-mgmt: surface "not supported on Windows" instead of empty-list/false silent return in `discoverWatchers`, `getActiveCwds`, `stopWatcher` (`src/watcher_mgmt.zig:121,146,164`). Either log a one-line warning before short-circuiting OR gate the commands at the CLI level with a clearer message. Reviewer: `incomplete-undefined` (WARN).
-- [ ] Restore HTTP server functionality — placeholder commit landed graceful error; the migration to `std.Io.net.IpAddress.listen` + `std.http.Server` v2 (io-aware API) still needs to happen. (Same item as PLAN.md:35 above.) Reviewer: `incomplete-undefined` (CRITICAL).
+- [x] Restore HTTP server functionality — DONE 2026-06-01. Migrated `serve()` to `std.Io.net.IpAddress.listen` + `std.http.Server` v2; smoke-tested end-to-end with curl. Reviewer: `incomplete-undefined` (CRITICAL).
 - [ ] Test coverage gaps for language extractors — `extract_lua.zig`, `extract_idris.zig`, `extract_nix.zig`, `extract_nim.zig`, `extract_haskell.zig`, `extract_lean.zig`, `extract_bash.zig`, `extract_text.zig`, `extract_log.zig` each have a single happy-path test. Establish a 6-test smoke matrix per extractor (function/method/no-doc/multi-doc/empty-file/UTF-8 identifier). Reviewer: `inadequate-tests` (WARN).
 - [ ] Enum-value stability test for `src/kind.zig` `Kind` enum — values persist to SQLite so reordering would silently break old indices. Add a snapshot assertion. Reviewer: `inadequate-tests` (WARN).
 - [ ] Strengthen 4 weak-assertion tests:

src/server.zig

@@ -87,24 +87,75 @@ pub fn serve(allocator: std.mem.Allocator, settings: Settings) !void {
 		.dialect = settings.embedding_dialect,
 		.auth_header = settings.embedding_auth_header,
 	};
+	// `embedder_adapter` must be `var` because `.embedder()` takes a mutable
+	// pointer — and the value must outlive the listen loop.
+	var embedder_adapter_mut = embedder_adapter;
+	const embedder = embedder_adapter_mut.embedder();
+
 	const address = try parseAddress(settings.http_host, settings.http_port);
-	_ = address;
-	_ = embedder_adapter;
-	// TODO(zig-0.16): migrate std.http.Server + std.net.Address.listen to the new
-	// std.Io.net.IpAddress.listen + std.http.Server v2 (io-aware) API. The
-	// refactor was deferred during the 0.15→0.16 port and has not landed.
-	// Surface a clear user-facing message instead of an opaque error code.
-	var stderr_buf: [4096]u8 = undefined;
-	var stderr_writer = io_singleton.stderrWriter(&stderr_buf);
-	const stderr = &stderr_writer.interface;
-	_ = stderr.writeAll(
-		"error: `codescan serve` is temporarily unavailable.\n" ++
-		"  The HTTP server is mid-migration to std.Io.net + std.http.Server v2 (Zig 0.16).\n" ++
-		"  Use `codescan search` for queries or `codescan mcp-serve` for the MCP/JSON-RPC stdio server.\n" ++
-		"  Track progress in PLAN.md (\"HTTP server\" — currently unchecked).\n",
-	) catch {};
-	_ = stderr.flush() catch {};
-	return error.HttpServerNotMigrated;
+	const io = io_singleton.getOrInit();
+
+	var net_server = address.listen(io, .{ .reuse_address = true }) catch |err| {
+		var sb: [4096]u8 = undefined;
+		var sw = io_singleton.stderrWriter(&sb);
+		const stderr = &sw.interface;
+		_ = stderr.print("error: could not listen on {s}:{d}: {s}\n", .{ settings.http_host, settings.http_port, @errorName(err) }) catch {};
+		_ = stderr.flush() catch {};
+		return err;
+	};
+	defer net_server.socket.close(io);
+
+	{
+		var sb: [4096]u8 = undefined;
+		var sw = io_singleton.stderrWriter(&sb);
+		const stderr = &sw.interface;
+		_ = stderr.print("codescan serve: listening on http://{s}:{d}/\n", .{ settings.http_host, settings.http_port }) catch {};
+		_ = stderr.flush() catch {};
+	}
+
+	// Per-connection buffers. The header buffer must be large enough to hold
+	// any single client's entire request head — `std.http.Server.receiveHead`
+	// returns `error.HttpHeadersOversize` if a client sends a bigger one.
+	var read_buf: [16 * 1024]u8 = undefined;
+	var write_buf: [16 * 1024]u8 = undefined;
+
+	while (true) {
+		var stream = net_server.accept(io) catch |err| {
+			var sb: [4096]u8 = undefined;
+			var sw = io_singleton.stderrWriter(&sb);
+			const stderr = &sw.interface;
+			_ = stderr.print("codescan serve: accept error: {s}\n", .{@errorName(err)}) catch {};
+			_ = stderr.flush() catch {};
+			continue;
+		};
+		defer stream.close(io);
+
+		var stream_reader = stream.reader(io, &read_buf);
+		var stream_writer = stream.writer(io, &write_buf);
+		var http_server = std.http.Server.init(&stream_reader.interface, &stream_writer.interface);
+
+		var request = http_server.receiveHead() catch |err| switch (err) {
+			error.HttpConnectionClosing => continue,
+			else => {
+				var sb: [4096]u8 = undefined;
+				var sw = io_singleton.stderrWriter(&sb);
+				const stderr = &sw.interface;
+				_ = stderr.print("codescan serve: receiveHead error: {s}\n", .{@errorName(err)}) catch {};
+				_ = stderr.flush() catch {};
+				continue;
+			},
+		};
+
+		handleRequest(allocator, &request, db, embedder, settings) catch |err| {
+			var sb: [4096]u8 = undefined;
+			var sw = io_singleton.stderrWriter(&sb);
+			const stderr = &sw.interface;
+			_ = stderr.print("codescan serve: handler error for {s}: {s}\n", .{ request.head.target, @errorName(err) }) catch {};
+			_ = stderr.flush() catch {};
+			// Best-effort 500 if nothing was sent yet.
+			request.respond("internal server error\n", .{ .status = .internal_server_error }) catch {};
+		};
+	}
 }
 
 fn ensureModelAvailableOrExit(