MCP Apps host

Sandboxed iframe speaking JSON-RPC ui/initialize and tools/call over postMessage. Period toggles and row inspect stay in the host. Sample payloads are local — no extra market fetch from the iframe.