fix: harden Magic Cabinet Docker setup

[logohere]

Summary

• prevent Windows CRLF checkouts from breaking the Linux entrypoint, with both Git line-ending policy and an image-build safeguard
• remove the forced linux/amd64 platform so Docker builds the host's native architecture
• default the local container to 2 CPUs and 2 GiB, with environment overrides
• cache Bun dependency installation separately from source changes
• add PowerShell and Bash local smoke checks for health, /live, and authenticated MCP initialization
• replace the Docker/MCP section with complete setup and troubleshooting documentation

Local verification

• Compose configuration validated
• clean production image build completed successfully
• unchanged rebuild completed with all expensive layers cached
• container reached healthy with the configured CPU and memory limits
• /live and authenticated MCP initialize responded successfully
• PowerShell and Bash scripts parsed successfully
• publishable diff contains no machine-specific home paths

Existing GitHub Actions workflows were intentionally left unchanged; these checks are local only.

[ss251]

Flag from the 08-02 pilot audit (full report: mvp#1003 comment): this branch is 16 commits behind dev, and its README/token hunks reinstate the removed magic-cabinet-dev default token — reverting b8aa85ef ("keep Magic Cabinet MCP local"), which made compose refuse to start without an explicit PASCAL_MCP_HTTP_TOKEN. The orthogonal pieces here are worth landing after a rebase: layer-cached bun install, the .gitattributes CRLF fix, docker/smoke-test.sh|.ps1, and the resource limits. Recommend dropping the token/README hunks in the rebase.

🤖 Generated with Claude Code