Re-add MCP bridge so Hermes can delegate to the real Claude Code CLI

Recreates the PR #17 change (closed without merging, then asked for back
after confirming a real ANTHROPIC_API_KEY would mean separate/duplicate
billing rather than actually using the Pro/Max subscription).

New POST /mcp endpoint (Streamable HTTP transport, stateless — fresh
McpServer+transport per request) exposing one tool, ask_claude_code: runs
the real `claude` binary against a prompt, billed against the subscription
rather than API credits. Works specifically because it's the actual CLI
making the request server-side. Read-only — no Edit/Write/git-push/
git-commit tools.

Also removes litellm-config.yaml's "anthropic-claude" model entry: it only
ever worked when the real claude CLI itself was the caller (proven earlier),
so having it listed as a selectable model was actively misleading — Hermes
picking it directly is exactly what produced the '401: Missing Anthropic
API Key' confusion that led back to this bridge. The MCP tool is the actual
working path now; general_settings.forward_client_headers_to_llm_api is
also removed since nothing uses it anymore.

Tested end-to-end locally again before pushing (built the image, ran it,
full MCP handshake via curl) — real 'pong' from the real claude CLI.

.env.example

@@ -21,6 +21,12 @@ GITEA_REGISTRY_IMAGE=gitea.apps.williamturner.eu/<your-gitea-username>/<repo-nam
 # Run `claude setup-token` interactively (needs a browser + Claude Pro/Max subscription)
 # to generate this — it's a long-lived OAuth token, not an API key.
 CLAUDE_CODE_OAUTH_TOKEN=
+# Any random string — shared secret for claude-agent's /mcp bridge endpoint (see
+# agent/src/mcpBridge.js), which lets Hermes delegate a question to the real `claude`
+# CLI (billed against the subscription above) via MCP. Register it in Hermes with:
+#   docker exec hermes hermes config set mcp_servers.claude-code.url http://claude-agent:3001/mcp
+#   docker exec hermes hermes config set 'mcp_servers.claude-code.headers.Authorization' 'Bearer <this value>'
+MCP_BRIDGE_KEY=
 
 # --- litellm (local LLM gateway — used by Hermes, see litellm-config.yaml) ---
 OPENROUTER_API_KEY=