feat: scaffold manager server with docker lifecycle and bearer-auth proxy

Lays the groundwork for remote-mcp-manager: an Express server that
runs installed MCP containers via dockerode (forcing host/port env
vars, no published ports, shared bridge network) and reverse-proxies
/mcp/:slug requests behind a per-installation Bearer token, resolving
the upstream target by inspecting the container's network IP rather
than relying on container-name DNS.

Validated end-to-end against a real cloned MCP repo (nixpacks build +
container run + authenticated proxy roundtrip); installations are
still a hardcoded in-memory list, replaced by SQLite in the next slice.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/server/src/config/env.ts

@@ -0,0 +1,6 @@
+export const config = {
+  port: Number(process.env.PORT ?? 3000),
+  // Docker in prod; a rootless Podman socket (e.g. /run/user/<uid>/podman/podman.sock) in local dev.
+  dockerSocketPath: process.env.DOCKER_SOCKET_PATH ?? "/var/run/docker.sock",
+  mcpNetworkName: process.env.MCP_NETWORK_NAME ?? "mcp-net",
+};