Add HTTP transport + bearer auth + Docker/Compose for self-hosting

Restore the Streamable HTTP transport (kept alongside stdio) guarded by a shared bearer token (MCP_AUTH_TOKEN, constant-time check; /health stays open for probes). Add mcp-server/Dockerfile, root docker-compose.yml and .dockerignore to run it as a container on the Gitea box. README documents hosting + connecting Claude Desktop via mcp-remote. Verified HTTP 401-without/200-with-token locally; npm ci validated for the image build.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

mcp-server/.env.example

@@ -8,3 +8,11 @@ SP_CLIENT_SECRET=your-client-secret-value-here
 
 # Optional safety: set to true to expose ONLY read tools (no create/update/delete).
 # SP_READONLY=false
+
+# --- HTTP transport (only when running with --http, e.g. in Docker) ---
+# Shared bearer token required on the /mcp endpoint. Generate a strong random
+# value, e.g.  openssl rand -hex 32
+# If left empty, the HTTP endpoint is UNAUTHENTICATED — don't do that off-LAN.
+# MCP_AUTH_TOKEN=
+# Port the HTTP server listens on (default 3838).
+# PORT=3838