feat!: file-based configuration and multiple OpenAPI specs

Configuration moves from environment variables to a YAML/JSON file,
located via --config, XMCP_CONFIG, or /etc/xmcp/xmcp.yml. String values
support ${VAR} interpolation for secrets.

One or more OpenAPI documents can be configured as specs[]; multiple
documents are mounted under unique namespaces and served on a single
transport, on one HTTP port. Tool filters, per-request API keys and
per-spec base URL/auth overrides live in the same file.

The Docker image no longer sets MCP_* defaults and expects the config
mounted at /etc/xmcp/xmcp.yml; the healthcheck reads the config.

Dockerfile

@@ -28,13 +28,11 @@ FROM python:3.14-alpine3.24 AS runtime
 
 ENV PYTHONDONTWRITEBYTECODE=1 \
     PYTHONUNBUFFERED=1 \
-    PATH="/app/.venv/bin:$PATH" \
-    MCP_TRANSPORT=http \
-    MCP_HOST=0.0.0.0 \
-    MCP_PORT=8000
+    PATH="/app/.venv/bin:$PATH"
 
 RUN addgroup -S -g 1001 xmcp \
- && adduser -S -D -H -u 1001 -G xmcp xmcp
+ && adduser -S -D -H -u 1001 -G xmcp xmcp \
+ && mkdir -p /etc/xmcp
 
 WORKDIR /app
 COPY --from=builder --chown=xmcp:xmcp /app/.venv /app/.venv
@@ -43,8 +41,8 @@ USER xmcp
 
 EXPOSE 8000
 
-# In HTTP mode, probe the MCP port; stdio containers are always healthy.
+# Probes the MCP HTTP port when the mounted configuration uses transport http.
 HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
-    CMD ["python", "-c", "import os, socket, sys\nif os.environ.get('MCP_TRANSPORT', 'stdio') != 'http':\n    sys.exit(0)\ns = socket.socket()\ns.settimeout(3)\nsys.exit(s.connect_ex(('127.0.0.1', int(os.environ.get('MCP_PORT', '8000')))))"]
+    CMD ["python", "-m", "xmcp.healthcheck"]
 
 CMD ["python", "-m", "xmcp"]