feat(mcp): systemd socket activation and healthz under /mcp (v0.1.1)

Patch release. Two changes to cmd/server, both motivated by running the
service behind a unix socket on a reverse-proxied host: the binary now
inherits a systemd-passed listener when present, and the healthz handler
moves under the same path prefix as the MCP endpoint so a single proxy
location forwards both. Bundled with two repository-hygiene changes.

cmd/server:
- chooseListener (new) — picks a listener at startup. When systemd has
  passed a LISTEN_FDS fd via github.com/coreos/go-systemd/v22/activation,
  the binary uses the inherited listener; otherwise it binds TCP at -addr
  as before. The startup log records "mode":"socket-activated" or
  "mode":"tcp" so operators can confirm which path is live. Same binary
  works for local dev and for systemd-managed deployment with no flags
  or env vars to toggle.
- Health probe path is now derived from -path. With the default -path /mcp
  the probe is served at /mcp/healthz; the legacy /healthz route is no
  longer registered. A reverse proxy can now route the whole MCP service
  through a single "/mcp" location prefix instead of maintaining a second
  forward for /healthz. Consumers of v0.1.0 that hit /healthz directly
  must switch to /mcp/healthz.

Dependencies:
- github.com/coreos/go-systemd/v22 v22.7.0 — listener inheritance via
  LISTEN_FDS. Loaded only by cmd/server.

Docs:
- README.md "Deployment" section rewritten to be hosting-agnostic. The
  v0.1.0 draft prescribed a specific systemd-on-HestiaCP layout; the new
  text points at the Dockerfile and at systemd socket activation as a
  supported binary mode without dictating one operator's setup. Adds an
  explicit note that any reverse proxy must disable response buffering on
  the /mcp location — streamable MCP delivers tool results via Server-Sent
  Events and default proxy buffering breaks the stream.

Repository hygiene:
- /deploy/ is now .gitignored. Local deployment artefacts (systemd units,
  reverse-proxy templates, per-release scripts) are operator-specific by
  design and live outside the public repository. The Dockerfile at the
  module root remains the only portable, public-facing build artefact.

No tool surface, no validation rules, no index schema, and no behaviour of
the indexer changed. Operators upgrading from v0.1.0 must update their
health-probe URL to /mcp/healthz (or whichever path matches their -path
flag); MCP-protocol clients (Claude, Cursor, Zed, etc.) need no changes.

cmd/server/main.go

@@ -9,6 +9,7 @@ import (
 	"flag"
 	"fmt"
 	"log/slog"
+	"net"
 	"net/http"
 	"os"
 
@@ -16,6 +17,7 @@ import (
 	"code.nochebuena.dev/einherjar/mcp/internal/index"
 	"code.nochebuena.dev/einherjar/mcp/internal/tools"
 
+	"github.com/coreos/go-systemd/v22/activation"
 	"github.com/modelcontextprotocol/go-sdk/mcp"
 )
 
@@ -50,17 +52,39 @@ func main() {
 
 	mux := http.NewServeMux()
 	mux.Handle(*path, handler)
-	mux.HandleFunc("/healthz", func(w http.ResponseWriter, _ *http.Request) {
+	mux.HandleFunc(*path+"/healthz", func(w http.ResponseWriter, _ *http.Request) {
 		fmt.Fprintln(w, "ok")
 	})
 
-	log.Info("listening", "addr", *addr, "path", *path)
-	if err := http.ListenAndServe(*addr, mux); err != nil {
+	ln, mode, err := chooseListener(*addr)
+	if err != nil {
+		log.Error("listen", "err", err)
+		os.Exit(1)
+	}
+	log.Info("listening", "mode", mode, "addr", ln.Addr().String(), "path", *path)
+
+	srv := &http.Server{Handler: mux}
+	if err := srv.Serve(ln); err != nil && err != http.ErrServerClosed {
 		log.Error("server", "err", err)
 		os.Exit(1)
 	}
 }
 
+// chooseListener returns a socket-activated listener when systemd inherited
+// one, falling back to a plain TCP listener on addr. The mode string is
+// "socket-activated" or "tcp" for logging.
+func chooseListener(addr string) (net.Listener, string, error) {
+	listeners, err := activation.Listeners()
+	if err == nil && len(listeners) > 0 {
+		return listeners[0], "socket-activated", nil
+	}
+	ln, err := net.Listen("tcp", addr)
+	if err != nil {
+		return nil, "", err
+	}
+	return ln, "tcp", nil
+}
+
 func envOr(key, def string) string {
 	if v := os.Getenv(key); v != "" {
 		return v