feat: scaffold manager server with docker lifecycle and bearer-auth proxy

Lays the groundwork for remote-mcp-manager: an Express server that
runs installed MCP containers via dockerode (forcing host/port env
vars, no published ports, shared bridge network) and reverse-proxies
/mcp/:slug requests behind a per-installation Bearer token, resolving
the upstream target by inspecting the container's network IP rather
than relying on container-name DNS.

Validated end-to-end against a real cloned MCP repo (nixpacks build +
container run + authenticated proxy roundtrip); installations are
still a hardcoded in-memory list, replaced by SQLite in the next slice.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.env.example

@@ -0,0 +1,10 @@
+# Port the manager's own HTTP server listens on (the operator's own nginx proxies to this)
+PORT=3000
+
+# Path to the Docker/Podman-API-compatible socket.
+# Production (Docker): /var/run/docker.sock
+# Local dev (rootless Podman): /run/user/<uid>/podman/podman.sock
+DOCKER_SOCKET_PATH=/var/run/docker.sock
+
+# Name of the shared container network joining the manager and every installed MCP container
+MCP_NETWORK_NAME=mcp-net