feat!: file-based configuration and multiple OpenAPI specs

Configuration moves from environment variables to a YAML/JSON file,
located via --config, XMCP_CONFIG, or /etc/xmcp/xmcp.yml. String values
support ${VAR} interpolation for secrets.

One or more OpenAPI documents can be configured as specs[]; multiple
documents are mounted under unique namespaces and served on a single
transport, on one HTTP port. Tool filters, per-request API keys and
per-spec base URL/auth overrides live in the same file.

The Docker image no longer sets MCP_* defaults and expects the config
mounted at /etc/xmcp/xmcp.yml; the healthcheck reads the config.

.gitignore

@@ -5,7 +5,8 @@ __pycache__/
 # uv / virtual environments
 .venv/
 
-# Local configuration
+# Local configuration (may contain secrets)
+xmcp.yml
+xmcp.local.yml
 .env
 .env.*
-!.env.example