feat!: file-based configuration and multiple OpenAPI specs

Configuration moves from environment variables to a YAML/JSON file,
located via --config, XMCP_CONFIG, or /etc/xmcp/xmcp.yml. String values
support ${VAR} interpolation for secrets.

One or more OpenAPI documents can be configured as specs[]; multiple
documents are mounted under unique namespaces and served on a single
transport, on one HTTP port. Tool filters, per-request API keys and
per-spec base URL/auth overrides live in the same file.

The Docker image no longer sets MCP_* defaults and expects the config
mounted at /etc/xmcp/xmcp.yml; the healthcheck reads the config.

.env.example

@@ -1,46 +0,0 @@
-# Copy to .env and adjust. All values are read at container/process start.
-
-# --- OpenAPI document (required) ---------------------------------------------
-# http(s) URL of a JSON/YAML OpenAPI document, or a local file path
-# (e.g. /spec/openapi.json when the document is mounted into the container).
-OPENAPI_SPEC_URL=https://petstore3.swagger.io/api/v3/openapi.json
-
-# Bearer token used only when fetching a remote spec (leave unset for public
-# documents).
-#OPENAPI_SPEC_TOKEN=
-
-# --- Target API ---------------------------------------------------------------
-# Override the base URL taken from the spec's servers[0].url. Required when the
-# spec only has a relative server URL and the spec is a local file, or when the
-# API lives on a different host than the spec.
-#API_BASE_URL=https://api.example.com
-
-# Credential sent to the target API on every tool call.
-#API_TOKEN=change-me
-#API_AUTH_HEADER=Authorization
-# Send the raw token with no scheme prefix by setting this to an empty value:
-#API_AUTH_SCHEME=
-
-# HTTP header treated as the per-request API key of the MCP client. When
-# present it takes precedence over API_TOKEN. Set to an empty value to disable
-# the mapping (default: X-API-Key).
-#MCP_API_KEY_HEADER=X-API-Key
-
-# --- MCP server ---------------------------------------------------------------
-# stdio or http (streamable-http is accepted as an alias); default: stdio
-MCP_TRANSPORT=http
-MCP_HOST=0.0.0.0
-MCP_PORT=8000
-#MCP_SERVER_NAME=My API
-
-# Comma-separated allowlists of tool names and OpenAPI tags to expose. Unset or
-# empty disables that filter; unknown entries are ignored with a startup
-# warning. When both are set, a tool must match both.
-#MCP_TOOLS_INCLUDED=getPetById,findPetsByStatus
-#MCP_TOOLS_TAGS_INCLUDED=pet
-
-# Timeout in seconds for fetching the spec and calling the API (default: 30).
-#HTTP_TIMEOUT=30
-
-# DEBUG, INFO, WARNING, ERROR, CRITICAL ... (default: INFO)
-#LOG_LEVEL=INFO