Add Docker image bundling mcpo + webfetch-mcp as HTTP/OpenAPI service

Vendors webfetch-mcp (pinned commit, from the code.aneur.in mirror) and
installs a pinned mcpo + mcp SDK version on a Python+Node base, wired
together via a runtime entrypoint script so MCPO_API_KEY can be supplied
at container start rather than baked into the image. Adds a Gitea Actions
workflow to build and push on push to main.

Closes #1

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

entrypoint.sh

@@ -0,0 +1,20 @@
+#!/bin/sh
+set -eu
+
+# mcpo's --api-key is a CLI flag, not something it reads from its own
+# environment, but the actual value must come from the container's
+# environment rather than being baked into the image. This script builds
+# the mcpo command line at container start so that can happen.
+#
+# webfetch-mcp reads SEARXNG_BASE / DEBUG / DETAILED_LOG from its own
+# process environment. No passthrough is needed here: mcpo builds the
+# spawned child's environment as {**os.environ, **extra}, so anything set
+# on this container's environment reaches webfetch-mcp automatically.
+
+PORT="${MCPO_PORT:-8000}"
+
+if [ -n "${MCPO_API_KEY:-}" ]; then
+  exec mcpo --host 0.0.0.0 --port "$PORT" --api-key "$MCPO_API_KEY" -- node /app/webfetch-mcp/server.mjs
+else
+  exec mcpo --host 0.0.0.0 --port "$PORT" -- node /app/webfetch-mcp/server.mjs
+fi