feat: scaffold manager server with docker lifecycle and bearer-auth proxy

Lays the groundwork for remote-mcp-manager: an Express server that
runs installed MCP containers via dockerode (forcing host/port env
vars, no published ports, shared bridge network) and reverse-proxies
/mcp/:slug requests behind a per-installation Bearer token, resolving
the upstream target by inspecting the container's network IP rather
than relying on container-name DNS.

Validated end-to-end against a real cloned MCP repo (nixpacks build +
container run + authenticated proxy roundtrip); installations are
still a hardcoded in-memory list, replaced by SQLite in the next slice.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/server/tsconfig.json

@@ -0,0 +1,13 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "outDir": "dist",
+    "rootDir": "src",
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true
+  },
+  "include": ["src"]
+}