feat!: file-based configuration and multiple OpenAPI specs

Configuration moves from environment variables to a YAML/JSON file,
located via --config, XMCP_CONFIG, or /etc/xmcp/xmcp.yml. String values
support ${VAR} interpolation for secrets.

One or more OpenAPI documents can be configured as specs[]; multiple
documents are mounted under unique namespaces and served on a single
transport, on one HTTP port. Tool filters, per-request API keys and
per-spec base URL/auth overrides live in the same file.

The Docker image no longer sets MCP_* defaults and expects the config
mounted at /etc/xmcp/xmcp.yml; the healthcheck reads the config.

docker-compose.yml

@@ -3,16 +3,9 @@ services:
     build:
       context: .
     image: xmcp:latest
-    env_file:
-      - .env
-    environment:
-      MCP_TRANSPORT: http
-      MCP_HOST: 0.0.0.0
-      MCP_PORT: "8000"
+    volumes:
+      - ./xmcp.yml:/etc/xmcp/xmcp.yml:ro
+    # The container port must match server.port in xmcp.yml.
     ports:
-      - "${MCP_PORT:-8000}:${MCP_PORT:-8000}"
+      - "8000:8000"
     restart: unless-stopped
-    # To serve a locally stored OpenAPI document, mount it and point
-    # OPENAPI_SPEC_URL at the in-container path:
-    # volumes:
-    #   - ./openapi.json:/spec/openapi.json:ro