test(fuzz): arbitrary bytes into the HTTP door and the upload path (P12)

P2 promised these two targets and never added them. `fuzz_http_mcp_request`
feeds a method, a path, headers (token present, absent, wrong, raw) and a
JSON-RPC body drawn from the real method and tool names into the in-process
router. Whatever arrives, the door answers: no token live for the book is
refused 4xx, never run (INVARIANT 8), and a live token never makes the door
fail (no 5xx on the MCP route). Whether a token is live is asked of the door
itself (`FuzzDoor::carries_a_token`), so a token smuggled in an extra header
is judged by the real rule rather than by the target's guess.

`fuzz_upload_put` declares a size and a hash and sends bytes: taken only
when both are exactly what was declared, from the token the grant names,
and only once (INVARIANT 9); a 200 for anything else is the bug.

Both join the weekly matrix in scheduled.yml; fuzz/Cargo.lock gains
ledger-mcp's dependency closure because the targets drive its router.

fuzz/Cargo.toml

@@ -24,6 +24,10 @@ path = "../crates/ledger-store"
 [dependencies.ledger-import]
 path = "../crates/ledger-import"
 
+[dependencies.ledger-mcp]
+path = "../crates/ledger-mcp"
+features = ["fuzzing"]
+
 [dependencies.ledger-config]
 path = "../crates/ledger-config"
 
@@ -105,3 +109,17 @@ path = "fuzz_targets/fuzz_settings_replay.rs"
 test = false
 doc = false
 bench = false
+
+[[bin]]
+name = "fuzz_http_mcp_request"
+path = "fuzz_targets/fuzz_http_mcp_request.rs"
+test = false
+doc = false
+bench = false
+
+[[bin]]
+name = "fuzz_upload_put"
+path = "fuzz_targets/fuzz_upload_put.rs"
+test = false
+doc = false
+bench = false