Add read-only Sentinel MCP server

infra/mcp-server/.env.example

@@ -0,0 +1,13 @@
+# Dedicated, read-only PostgreSQL login. Do not reuse the n8n or ingest role.
+DB_HOST=ocsentinel-postgres
+DB_PORT=5432
+DB_NAME=ocsentinel
+DB_USER=ocsentinel_mcp
+DB_PASSWORD=replace-with-a-long-random-password
+
+# A long random bearer token for trusted MCP clients. Keep this file private.
+MCP_AUTH_TOKEN=replace-with-a-second-long-random-token
+
+# Validate browser origins and Host headers when they are present.
+MCP_ALLOWED_ORIGINS=http://localhost:6274,http://127.0.0.1:6274
+MCP_ALLOWED_HOSTS=localhost:8091,127.0.0.1:8091