Fix News auth routing and add Docker Compose deployment

[hexonal]

Summary

• fix searchNews / /2/news... calls by routing those endpoints through X_BEARER_TOKEN instead of OAuth1 user signing
• keep OAuth1 user signing for write/user-context endpoints such as createPosts and deletePosts
• disable OpenAPI output validation by default because live X News responses can differ from the published response schema, for example missing rest_id
• add optional MCP Bearer token protection via MCP_AUTH_TOKEN
• persist OAuth1 access token/secret after the first approval so container restarts do not require reauthorization
• add Dockerfile, docker-compose deployment, env example, deployment notes, and an interactive secret setup helper

Why

X rejects OAuth1 user authentication for News endpoints with Unsupported Authentication; supported auth for those endpoints is OAuth2 application-only or OAuth2 user context. The server previously signed every X API request with OAuth1, so searchNews failed while searchPostsRecent worked.

Validation

• python3 -m py_compile server.py
• docker compose up -d --build on deployment host
• verified searchNews succeeds without 403
• verified searchPostsRecent still succeeds
• verified createPosts succeeds and deletePosts deletes the smoke-test post
• verified unauthenticated MCP requests return 401 when MCP_AUTH_TOKEN is configured

[CLAassistant]

All committers have signed the CLA.