v0.1.1: --mcp-source flag + sources.yaml so users don't need to write Go

[shreyanshjain7174]

What

Wire the existing internal/sources/mcp.Importer into the acp-server binary so users with existing MCP servers can plug them in via a single config file or repeated CLI flag, no Go code required.

Today the import flow works (verified end-to-end via cmd/import-demo) but acp-server boots with a 5-tool seed registry. Anyone with real MCP servers in production has to vendor the importer into a custom main.go. That's the wrong surface for an OSS install.

Proposed

Two equivalent ways to declare upstream MCP sources:

A. Repeated CLI flag

acp-server --addr :8080 \
  --mcp-source name=files,url=http://localhost:9090,caps=filesystem \
  --mcp-source name=github,url=http://gh-mcp.internal:9100,auth='bearer ${GITHUB_TOKEN}',caps=git

B. sources.yaml (preferred for >2 sources)

sources:
  - name: files
    type: mcp
    url: http://localhost:9090
    capabilities: [filesystem]
  - name: github
    type: mcp
    url: http://gh-mcp.internal:9100
    auth: "bearer ${GITHUB_TOKEN}"   # env-var expansion
    capabilities: [git]

acp-server --addr :8080 --sources-file ./sources.yaml

Acceptance

• --mcp-source flag, repeatable, parses the same key=value,key=value shape as cmd/import-demo.
• --sources-file flag accepts YAML, env-var expansion via ${VAR}.
• Importer runs at boot before the HTTP listener binds; failure of any single source is logged + skipped, not fatal (unless all sources fail).
• --reimport-interval flag (default 0 = never) for periodic refresh.
• /v1/sources introspection endpoint returns [{name, url, last_imported_at, tool_count, last_error}].
• README "Use with your existing MCP servers" updated to use these flags as the primary path; the Go-importer demo demoted to "if you need to embed the importer in your own binary".
• Integration test in tests/ that boots the fake MCP server (scripts/fake-mcp.py), starts acp-server with --mcp-source, and asserts the imported tools appear in /v1/context responses.

Why P0 for v0.1.1

This is the gap between "demo" and "you can actually use this against your stack." The README already promises the integration; we need the binary to deliver it without a Go vendoring step.

Out of scope

• stdio-transport MCP servers (tracked separately for v0.2 in feat: deferred intent bridge + observability + e2e tests #14).
• Hot-reload of sources.yaml without restart (tracked for v0.2).
• Per-source RBAC (tracked alongside the auth model rework).