feat: enhance MCP server deployment instructions and add Docker support

[malto101]

Add Docker support for optics mcp (HTTP transport on port 8090)

• Containerized MCP uses HTTP only (http://:8090/mcp); stdio remains for local MCP clients.
• MCP and optics serve use separate in-memory sessions — clients must call start_session per process.
• Prod MCP needs a PyPI release that includes the [mcp] extra; until then, use mcp-dev with a local wheel (poetry build + --build-arg WHL_FILE=...).

[kun-codes]

I feel we should use multistage docker builds because it would lead to smaller docker images and lesser attack surface

[kun-codes]

Also for production dockerfiles, we should use docker hardened images as they have been made free for use a few months back

[malto101]

I feel we should use multistage docker builds because it would lead to smaller docker images and lesser attack surface

Looked into multistage for prod earlier, it works, but only saves ~180–230 MB (3–6%) because ~6.5 GB of our image is Playwright + PyTorch/EasyOCR, which can't be build-stage-only. It also adds complexity around browser install, EasyOCR model paths, and cross-stage site-packages copies, I've had this break before. Modest compiler removal isn't worth the maintenance cost in this PR

[malto101]

Also for production dockerfiles, we should use docker hardened images as they have been made free for use a few months back

we can do this once with Mozark's account, DHI requires signing in dhi.io

also its not a drop in replacement
as

1. we use a lot of system packages here. dhi base doesnt have system packages off the shelf (so no apt-get)
2. a lot of frame buffer/GUI libs will be missing which is needed for our x11 server and playwright

we could you hardern the docker base image tags to SHA, to pin it in the future.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube Cloud