feat: run docs-mcp as a long-lived shared HTTP service

context-docs was previously spawned per call as a fresh stdio container,
which meant every MCP request paid full cold-start cost (embedding model
load + Chroma open) and concurrent clients raced for the same Chroma
writer. The 50+ orphan container build-up I saw during the publish audit
was the visible symptom.

This refactor runs docs-mcp as one long-lived service:

- compose: docs-mcp leaves the 'mcp' profile, gets container_name,
  restart: unless-stopped, healthcheck, and a host port (127.0.0.1:8776
  by default). Runs as the host UID/GID so bind mounts don't end up
  root-owned.
- docker image: adds mcp-proxy (0.12.0) and an entrypoint that fronts
  llms-txt-mcp's stdio as Streamable HTTP. Reads sources from a flat
  file mounted at /etc/context-kit/docs-sources.txt. Disables eager
  preindex by default; callers refresh on demand via the docs_refresh
  tool. Set CONTEXT_KIT_DOCS_PREINDEX=1 to restore eager behavior.
- bin/context-kit: 'start' brings up the docs service alongside SearXNG,
  generates the sources file from CONTEXT_KIT_DOCS_SOURCES, and waits
  for the HTTP endpoint to become ready (up to 180s for first-run model
  download). 'docs' still works for stdio-only clients but is now a
  thin mcp-proxy bridge onto the shared HTTP service. 'doctor' and
  'status' both surface the new endpoint.
- install snippets: context-docs is now 'type: remote'/'type: http'
  pointing at ${CONTEXT_KIT_DOCS_HTTP_URL}. HTTP-capable MCP clients
  bypass the bridge entirely. snippets/*.json and the install command
  output stay byte-identical.
- docs and .env.example updated for new vars (CONTEXT_KIT_DOCS_PORT,
  CONTEXT_KIT_DOCS_HTTP_URL, CONTEXT_KIT_DOCS_PREINDEX) and the new
  24h TTL default (down from 7d; the long-lived service makes shorter
  defaults cheap).

Verified end-to-end:
- compose config -q, bash -n, sh -n all clean
- HTTP /status returns 200
- stdio bridge returns initialize + tools/list with the same 3 tools
  (docs_sources, docs_refresh, docs_query)
- doctor passes all 10 checks including the new HTTP probe
- web-search and repomix MCP handshakes still work
- redaction-check clean
- install JSON valid for both targets + --absolute

compose.yml

@@ -36,12 +36,35 @@ services:
     build:
       context: ./docker/docs
     image: context-kit/docs-mcp:latest
-    profiles: ["mcp"]
-    stdin_open: true
-    tty: false
+    # Long-lived shared docs MCP. One container = one Chroma writer; clients
+    # connect over Streamable HTTP (mcp-proxy bridges llms-txt-mcp's stdio).
+    container_name: context-kit-docs-mcp
+    restart: unless-stopped
+    ports:
+      - "127.0.0.1:${CONTEXT_KIT_DOCS_PORT:-8776}:8000"
+    # Run as the host user so bind-mounted /data isn't owned by root.
+    user: "${CONTEXT_KIT_DOCS_UID:-1000}:${CONTEXT_KIT_DOCS_GID:-1000}"
+    environment:
+      HOME: /tmp
+      USER: context-kit
+      LOGNAME: context-kit
+      TORCHINDUCTOR_CACHE_DIR: /tmp/torchinductor
+      DOCS_MCP_TTL: "${CONTEXT_KIT_DOCS_TTL:-24h}"
+      DOCS_MCP_MAX_GET_BYTES: "${CONTEXT_KIT_DOCS_MAX_GET_BYTES:-75000}"
+      DOCS_MCP_EMBED_MODEL: "${CONTEXT_KIT_DOCS_EMBED_MODEL:-BAAI/bge-small-en-v1.5}"
+      # Preindex on startup is off by default; use the docs_refresh tool to
+      # refresh on demand. Set CONTEXT_KIT_DOCS_PREINDEX=1 to restore eager.
+      DOCS_MCP_PREINDEX: "${CONTEXT_KIT_DOCS_PREINDEX:-0}"
     volumes:
       - ${CONTEXT_KIT_DATA_DIR:-${HOME}/.local/share/context-kit}/docs:/data
       - ${CONTEXT_KIT_DATA_DIR:-${HOME}/.local/share/context-kit}/models:/models
+      - ${CONTEXT_KIT_DATA_DIR:-${HOME}/.local/share/context-kit}/docs-sources.txt:/etc/context-kit/docs-sources.txt:ro
+    healthcheck:
+      test: ["CMD-SHELL", "python -c \"import urllib.request,sys; sys.exit(0 if urllib.request.urlopen('http://127.0.0.1:8000/status', timeout=2).status < 500 else 1)\""]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 60s
     labels:
       dev.context-kit: "true"