fix: production deployment hardening

Docker:
- Restrict PostgreSQL port to 127.0.0.1 only (not exposed to LAN)
- Add APP_BASE_URL for MCP server to reach Next.js via Docker network
- Fix MCP healthcheck (remove always-passing fallback)
- Add resource limits to mcp-server container

Dockerfile:
- Remove full node_modules copy (standalone already includes deps)
  Reduces image size by ~500MB+

Config:
- Add MCP_SERVER_MODE and MCP_SERVER_URL to deploy.sh and .env.docker.example
- Deploy script now auto-sets MCP_SERVER_URL based on NEXTAUTH_URL

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

.env.docker.example

@@ -41,6 +41,9 @@ POSTGRES_PASSWORD=memento
 # Mode: 'stdio' (Claude Desktop, Cline) or 'sse' (N8N, HTTP)
 MCP_MODE="stdio"
 MCP_PORT="3001"
+# Frontend MCP settings (for the MCP settings panel in the web UI)
+# MCP_SERVER_MODE="sse"
+# MCP_SERVER_URL="http://YOUR_IP:3001"
 
 # =============================================================================
 # AI PROVIDER - TAGS GENERATION