Add read-only Sentinel MCP server

infra/mcp-server/Dockerfile

@@ -0,0 +1,16 @@
+FROM python:3.13-alpine
+
+WORKDIR /app
+ENV PYTHONDONTWRITEBYTECODE=1 \
+    PYTHONUNBUFFERED=1
+
+COPY requirements.txt .
+RUN pip install --no-cache-dir -r requirements.txt
+
+COPY server.py .
+
+RUN addgroup -S ocsentinel && adduser -S ocsentinel -G ocsentinel
+USER ocsentinel
+
+EXPOSE 8080
+CMD ["uvicorn", "server:app", "--host", "0.0.0.0", "--port", "8080", "--proxy-headers", "--no-access-log"]