feat(mcp): stdio MCP server exposing the full API as tools

Add containr-mcp so MCP-compatible agents (Claude, Cursor, Devin)
operate the platform directly — ROADMAP2 phase A3. Reuses the CLI's
thin client and PAT auth; zero duplicated resource logic.

- ~60 containr_* tools across projects, services, deployments, logs,
  exec, variables, databases, cron, templates, nodes, scaling, ha,
  security, gateway, admin, notifications, tokens
- declarative tool specs → {param} path substitution, GET extras become
  query params, remaining args form the request body
- destructive tools require confirm:true and return isError without it
- results are pretty JSON; API error envelopes surface as isError
- configured via CONTAINR_API_URL + CONTAINR_TOKEN env; official
  modelcontextprotocol/go-sdk over StdioTransport

Verified over stdio: initialize + tools/list, auth_status returns the
token owner's identity, projects list, destructive refusal, token
creation through MCP.

Authored By: TDvorak <[email protected]>

app/backend/cmd/mcp/main.go

@@ -0,0 +1,39 @@
+package main
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"os/signal"
+	"strings"
+	"syscall"
+
+	"containr/internal/mcpserver"
+)
+
+// Injected at build time via -ldflags.
+var Version = "dev"
+
+// containr-mcp exposes the whole Containr API as MCP tools over stdio.
+// Configure it in an MCP client with:
+//
+//	command: containr-mcp
+//	env: CONTAINR_API_URL, CONTAINR_TOKEN (a cnp_ personal access token)
+func main() {
+	apiURL := os.Getenv("CONTAINR_API_URL")
+	if apiURL == "" {
+		apiURL = "http://localhost:8080/api/v1"
+	}
+	apiURL = strings.TrimSuffix(apiURL, "/")
+	if !strings.HasSuffix(apiURL, "/api/v1") {
+		apiURL += "/api/v1"
+	}
+
+	ctx, stop := signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM)
+	defer stop()
+
+	if err := mcpserver.Run(ctx, apiURL, os.Getenv("CONTAINR_TOKEN"), Version); err != nil {
+		fmt.Fprintf(os.Stderr, "containr-mcp: %v\n", err)
+		os.Exit(1)
+	}
+}