feat(mcp): migrate to mcp 2.x (MCPServer), lift the <2 pin

mcp 2.0.0 removed `mcp.server.fastmcp`. This repo was pinned to <2
(6723829) to stop a rebuild from crash-looping the container the way
seed-mcp (2026-09-01) and zerto-docs (2026-08-11) did. This lifts the
pin by doing the port — the same mechanical change as
justin/seed-mcp#23 and justin/morpheus-docs#10.

- import: FastMCP -> MCPServer, plus TransportSecuritySettings
- constructor takes no transport options: MCPServer(f"{PRODUCT_NAME}-docs")
- host/port/stateless_http/transport_security are run() kwargs;
  `mcp.settings` no longer exists
- requirement becomes plain `mcp>=2,<3` (2.x has no [fastmcp] extra)

@mcp.tool() decorators and all handler signatures are unchanged.

CI now smokes `import docs_mcp.server` twice in both workflows — once
after pip install, once inside the built image — so a green build can
never ship a non-importing container again.

Verified on python:3.12-slim (matches the image):
- tools/list dumped in wire format is BYTE-FOR-BYTE IDENTICAL between
  mcp 1.30.0 and 2.2.0, all 10 tools
- streamable-http boots; initialize returns HTTP 200, both from
  localhost and with a container-DNS `Host: hvm-docs-mcp:8000` header
  (passing host= to run() keeps DNS-rebinding protection off)
- no mcp-session-id response header, i.e. stateless_http is in effect
- stdio boots; initialize + tools/list return 10 tools
- production image builds and imports under mcp 2.2.0; httpx 0.28.1 and
  httpx2 2.12.0 coexist as expected

Retrieval is untouched, so no eval numbers are included.

Closes #12

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01QBx2P1VhKQEzJWoZ96QcnH

CLAUDE.md

@@ -68,7 +68,7 @@ Cursor, etc.).
 │   ├── index.py                  # Builds Chroma + BM25
 │   └── bm25.py                   # SQLite FTS5 lexical index
 ├── docs_mcp/                     # Phase 3+ — MCP server
-│   ├── server.py                 # FastMCP + tool definitions
+│   ├── server.py                 # MCPServer + tool definitions
 │   └── usage.py                  # TimedCall telemetry
 ├── eval/                         # Phase 7 — golden-query harness
 │   ├── queries.jsonl.example
@@ -139,7 +139,8 @@ need:
 - **Lexical store**: SQLite FTS5 (stdlib)
 - **Fusion**: Reciprocal Rank Fusion with k=60
 - **Transport**: streamable-HTTP in prod, stdio for local dev
-- **MCP framework**: FastMCP with `stateless_http=True`
+- **MCP framework**: `mcp.server.mcpserver.MCPServer` (mcp 2.x),
+  with `stateless_http=True` passed to `run()`
 - **Container deploy**: Watchtower auto-pull on `:latest`, rollback
   via `:<sha12>` pin
 
@@ -148,7 +149,7 @@ need:
 The template uses `PRODUCT_NAME` env var (defaults to `"myproduct"`)
 throughout. Set it on first build. References show up in:
 
-- `docs_mcp/server.py` — `FastMCP(f"{PRODUCT_NAME}-docs", ...)`
+- `docs_mcp/server.py` — `MCPServer(f"{PRODUCT_NAME}-docs")`
 - Collection name (`<product>_docs`)
 - BM25 db filename
 - Tool names that include the product name (e.g., the `_api_lessons`
@@ -211,10 +212,12 @@ python -m scrape.changelog --history-out corpus/.digest/history.jsonl --history-
   ENTIRE batch if any doc exceeds `n_ctx_train=1024`. Truncate docs
   to ~2000 chars before sending to rerank. Full chunk text still
   goes back to the user; truncation is reranking-only.
-- **FastMCP `stateless_http=True`**: critical for production
-  hosting behind Watchtower auto-updates. Without it, every
-  container recreate produces a 404 storm from clients with
-  stale session IDs.
+- **`stateless_http=True`**: critical for production hosting
+  behind Watchtower auto-updates. Without it, every container
+  recreate produces a 404 storm from clients with stale session
+  IDs. Under mcp 2.x it is a `mcp.run()` kwarg, not a constructor
+  arg — along with `host`, `port` and `transport_security`.
+  `mcp.settings` no longer exists.
 - **Runner shell is `/bin/sh` (dash)**: no `${VAR::N}` substring
   expansion in workflow scripts. Use `cut`/`awk`/`printf`.
 - **Cloudflare 100 MB body cap**: if pushing through a Cloudflare-