feat(mcp): migrate to mcp 2.x (MCPServer), lift the <2 pin

mcp 2.0.0 removed `mcp.server.fastmcp`. This repo was pinned to <2
(6723829) to stop a rebuild from crash-looping the container the way
seed-mcp (2026-09-01) and zerto-docs (2026-08-11) did. This lifts the
pin by doing the port — the same mechanical change as
justin/seed-mcp#23 and justin/morpheus-docs#10.

- import: FastMCP -> MCPServer, plus TransportSecuritySettings
- constructor takes no transport options: MCPServer(f"{PRODUCT_NAME}-docs")
- host/port/stateless_http/transport_security are run() kwargs;
  `mcp.settings` no longer exists
- requirement becomes plain `mcp>=2,<3` (2.x has no [fastmcp] extra)

@mcp.tool() decorators and all handler signatures are unchanged.

CI now smokes `import docs_mcp.server` twice in both workflows — once
after pip install, once inside the built image — so a green build can
never ship a non-importing container again.

Verified on python:3.12-slim (matches the image):
- tools/list dumped in wire format is BYTE-FOR-BYTE IDENTICAL between
  mcp 1.30.0 and 2.2.0, all 10 tools
- streamable-http boots; initialize returns HTTP 200, both from
  localhost and with a container-DNS `Host: hvm-docs-mcp:8000` header
  (passing host= to run() keeps DNS-rebinding protection off)
- no mcp-session-id response header, i.e. stateless_http is in effect
- stdio boots; initialize + tools/list return 10 tools
- production image builds and imports under mcp 2.2.0; httpx 0.28.1 and
  httpx2 2.12.0 coexist as expected

Retrieval is untouched, so no eval numbers are included.

Closes #12

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01QBx2P1VhKQEzJWoZ96QcnH

.gitea/workflows/image-only.yml

@@ -59,6 +59,9 @@ jobs:
           python -m pip install -q --upgrade pip
           python -m pip install -q -r requirements.txt
 
+      - name: Smoke — server module imports
+        run: python -c "import docs_mcp.server"
+
       - name: Refresh digest history
         # Cheap (few seconds). Without this step, a code-only deploy
         # would ship an increasingly-stale digest history.
@@ -124,6 +127,17 @@ jobs:
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
 
+      - name: Smoke — image must import docs_mcp.server
+        # mcp 2.x renamed mcp.server.fastmcp -> mcp.server.mcpserver, so an
+        # unpinned dep produced a green build that crash-looped in prod
+        # (seed-mcp 2026-09-01, zerto-docs 2026-08-11). Import is
+        # side-effect-free here (lazy singletons), so this needs no
+        # Ollama/Chroma.
+        run: |
+          IMAGE="${{ steps.repo.outputs.owner }}/${{ steps.repo.outputs.name }}"
+          docker run --rm --entrypoint python \
+            "${REGISTRY_PUSH}/${IMAGE}:latest" -c "import docs_mcp.server"
+
       - name: Link container package to this repo
         env:
           GITEA_TOKEN: ${{ secrets.REGISTRY_TOKEN }}