deps: migrate to mcp 2.x (lift the <2 pin) (#6)

Co-authored-by: claude <[email protected]>

CLAUDE.md

@@ -68,7 +68,7 @@ Cursor, etc.).
 │   ├── index.py                  # Builds Chroma + BM25
 │   └── bm25.py                   # SQLite FTS5 lexical index
 ├── docs_mcp/                     # Phase 3+ — MCP server
-│   ├── server.py                 # FastMCP + tool definitions
+│   ├── server.py                 # MCPServer + tool definitions
 │   └── usage.py                  # TimedCall telemetry
 ├── eval/                         # Phase 7 — golden-query harness
 │   ├── queries.jsonl.example
@@ -124,7 +124,8 @@ need:
 - **Lexical store**: SQLite FTS5 (stdlib)
 - **Fusion**: Reciprocal Rank Fusion with k=60
 - **Transport**: streamable-HTTP in prod, stdio for local dev
-- **MCP framework**: FastMCP with `stateless_http=True`
+- **MCP framework**: `mcp.server.mcpserver.MCPServer` (mcp 2.x),
+  run with `stateless_http=True`
 - **Container deploy**: Watchtower auto-pull on `:latest`, rollback
   via `:<sha12>` pin
 
@@ -133,7 +134,7 @@ need:
 The template uses `PRODUCT_NAME` env var (defaults to `"myproduct"`)
 throughout. Set it on first build. References show up in:
 
-- `docs_mcp/server.py` — `FastMCP(f"{PRODUCT_NAME}-docs", ...)`
+- `docs_mcp/server.py` — `MCPServer(f"{PRODUCT_NAME}-docs")`
 - Collection name (`<product>_docs`)
 - BM25 db filename
 - Tool names that include the product name (e.g., the `_api_lessons`
@@ -200,10 +201,16 @@ python -m scrape.changelog --history-out corpus/.digest/history.jsonl --history-
   ENTIRE batch if any doc exceeds `n_ctx_train=1024`. Truncate docs
   to ~2000 chars before sending to rerank. Full chunk text still
   goes back to the user; truncation is reranking-only.
-- **FastMCP `stateless_http=True`**: critical for production
-  hosting behind Watchtower auto-updates. Without it, every
-  container recreate produces a 404 storm from clients with
-  stale session IDs.
+- **`stateless_http=True`**: critical for production hosting
+  behind Watchtower auto-updates. Without it, every container
+  recreate produces a 404 storm from clients with stale session
+  IDs. Under mcp 2.x this is a `mcp.run()` kwarg, not a
+  constructor arg — see `main()` in `docs_mcp/server.py`.
+- **mcp 2.x, not 1.x**: `mcp.server.fastmcp` was removed in 2.0.0.
+  This server uses `mcp.server.mcpserver.MCPServer`; `mcp.settings`
+  no longer exists (host/port/transport_security are `run()`
+  kwargs). PLAN.md still describes the 1.x API — it tracks the
+  upstream template, not this repo.
 - **Runner shell is `/bin/sh` (dash)**: no `${VAR::N}` substring
   expansion in workflow scripts. Use `cut`/`awk`/`printf`.
 - **Cloudflare 100 MB body cap**: if pushing through a Cloudflare-