deps: pin mcp<2 — 2.0.0 removed mcp.server.fastmcp

mcp 2.0.0 moved mcp.server.fastmcp to mcp.server.mcpserver, renamed FastMCP
to MCPServer, and drops the [fastmcp] extra this file requests. With no upper
bound, the next image rebuild resolves to 2.0.0 and the server crash-loops on
import.

That is not hypothetical: it happened to zerto-docs on 2026-08-11 at 02:27
UTC and took the server down until the host was rolled back. This repo shares
the same unpinned line and would fail identically on its next rebuild.

A ceiling, not a migration. The 2.x port is small (the import, the
constructor, and stateless_http moving from the constructor to run()) but it
changes how tool schemas are emitted, which is what decides tool routing, so
it wants a before/after tools/list diff rather than a version bump.

requirements.txt

@@ -1,5 +1,11 @@
 # MCP server
-mcp[fastmcp]>=1.0.0
+# Pinned below 2.0: mcp 2.0.0 removed `mcp.server.fastmcp`, which this
+# server imports. The unpinned floor pulled 2.0.0 into a rebuild on
+# 2026-08-11 and crash-looped zerto-docs with
+# "ModuleNotFoundError: No module named 'mcp.server.fastmcp'".
+# 2.0 also drops the [fastmcp] extra. Migrating to the 2.x API is a
+# deliberate piece of work — do not lift this pin without it.
+mcp[fastmcp]>=1.0.0,<2
 pydantic>=2.0
 httpx>=0.27