feat: self-host with Docker Compose and optional server-held keys

[kannan983]

Closes #98

Stacked on #99. Widgets need its duplicate-streaming fix when the agent uses .env keys, which is the case this PR enables. The commits from #99 drop out of this diff once it's merged.

Summary

Self-host the app, agent and MCP server with one command, using the agent's own keys.

• docker-compose.yml: agent (internal only, health check on /health), mcp (127.0.0.1:3100) and app (127.0.0.1:${APP_PORT:-3000}), all with restart: unless-stopped. The agent reads apps/agent/.env; the app reaches the agent at http://agent:8123 and MCP at http://mcp:3100/mcp.
• apps/agent/Dockerfile: uv image, uv sync --frozen --no-dev, copies only main.py, src/ and skills/.
• docker/Dockerfile.mcp: builds from the workspace root, because apps/mcp depends on @repo/design-system (workspace:*). The existing apps/mcp/Dockerfile expects a lockfile that doesn't exist.
• NEXT_PUBLIC_SERVER_KEYS (build arg in docker/Dockerfile.app; compose sets it to true): hasKeys is true without browser keys, so the prompt is skipped and requests go out without key headers. The agent then uses its .env keys. It's unset by default, so the hosted BYOK flow is unchanged and browser keys still work when the flag is on.
• docs/getting-started.md: a "Run with Docker Compose" section and the new variable.

Testing

• docker compose build: all three images build from a clean checkout of this branch.
• docker compose up -d: chat works at localhost with keys only in apps/agent/.env; no browser prompt. The MCP initialize request succeeds at http://localhost:3100/mcp.
• New frontend test: with NEXT_PUBLIC_SERVER_KEYS=true, the provider reports keys as configured and sends no browser key headers. It fails without the change.
• pnpm test and pnpm lint pass; agent tests pass.