feat: expose knowledge-base documentation through an MCP server

[oto-macenauer-absa]

What

Expose generated documentation through a public, read-only MCP endpoint so compatible AI agents can discover, search, and read Knowledge Base content without authentication.

Changes

• Generate a sanitised, deterministic MCP corpus and bundled Streamable HTTP server at build time.
• Serve POST /knowledge-base/mcp through nginx; supervise loopback Node MCP process with nginx.
• Add resource and document-discovery tools, validation, response limits, rate limiting, and Origin checks.
• Document MCP client setup, deployment gateway requirement, configuration, limits, and security model.
• Add extraction, search/ranking, user-query, MCP protocol, nginx-mirror, and container coverage.

Release notes

Knowledge Base deployments now expose an unauthenticated, read-only MCP endpoint at /knowledge-base/mcp. Deployment owners must allow unauthenticated POST forwarding for this path and set KB_MCP_PUBLIC_ORIGIN when agents need absolute document links.

Verification

• node scripts/setup-test-apps.mjs && npm run build:headless — green
• npm test — 237 passed
• npx playwright test --config=playwright.config.ci.js — 23 passed
• npx playwright test tests/mcp-server.spec.js — 6 passed
• npm run test:container — 37 passed
• npm audit --omit=dev --audit-level=high — green

Contract impact

contract/DEPLOYMENT.md changes deployment runtime and gateway requirements; artifact contract schemas remain unchanged.

Closes #117