feat!: file-based configuration and multiple OpenAPI specs

Configuration moves from environment variables to a YAML/JSON file,
located via --config, XMCP_CONFIG, or /etc/xmcp/xmcp.yml. String values
support ${VAR} interpolation for secrets.

One or more OpenAPI documents can be configured as specs[]; multiple
documents are mounted under unique namespaces and served on a single
transport, on one HTTP port. Tool filters, per-request API keys and
per-spec base URL/auth overrides live in the same file.

The Docker image no longer sets MCP_* defaults and expects the config
mounted at /etc/xmcp/xmcp.yml; the healthcheck reads the config.

xmcp.example.yml

@@ -0,0 +1,47 @@
+# xmcp configuration. Copy to xmcp.yml and adjust.
+# Settings are read from this file only; ${VAR} placeholders are filled from
+# the environment (a missing variable is a startup error).
+
+server:
+  name: xmcp
+  transport: http          # stdio | http
+  host: 0.0.0.0
+  port: 8000
+  log_level: INFO
+  http_timeout: 30
+  # Header from which MCP clients may supply a per-request API key.
+  # Empty string disables forwarding.
+  client_api_key_header: X-API-Key
+
+# Defaults applied to every OpenAPI document (per-spec `api` keys override).
+api:
+  # base_url: https://api.example.com
+  # token: ${API_TOKEN}
+  auth_header: Authorization
+  auth_scheme: Bearer      # "" sends the raw token
+
+# Optional global tool filters.
+# tools:
+#   include: [getPetById, findPetsByStatus]
+#   tags_include: [pet]
+
+specs:
+  # A single document needs no namespace; tool names stay unprefixed.
+  - spec_url: https://petstore3.swagger.io/api/v3/openapi.json
+    api:
+      base_url: https://petstore3.swagger.io/api/v3
+
+# Multiple documents: give every entry a unique namespace. Tools are then
+# exposed as "<namespace>_<tool>".
+# specs:
+#   - namespace: pet
+#     spec_url: https://petstore3.swagger.io/api/v3/openapi.json
+#     api:
+#       base_url: https://petstore3.swagger.io/api/v3
+#   - namespace: billing
+#     spec_url: ./specs/billing.yaml
+#     api:
+#       base_url: https://billing.example.com
+#       token: ${BILLING_TOKEN}
+#       auth_header: X-API-Key
+#       auth_scheme: ""