Phase 3: MCP HTTP clients + Dockerization

Wrapper async tipizzati sui sei servizi MCP HTTP che Cerbero Bite
consuma in autonomia. 277 test pass, copertura clients 93%, mypy
strict pulito, ruff clean.

Base layer:
- clients/_base.py: HttpToolClient con httpx + tenacity (retry
  esponenziale 3x, timeout 8s, mapping HTTP→eccezioni tipizzate).
- clients/_exceptions.py: McpAuthError, McpServerError, McpToolError,
  McpDataAnomalyError, McpNotFoundError, McpTimeoutError.
- config/mcp_endpoints.py: risoluzione URL via Docker DNS
  (mcp-deribit:9011, ...) con override per servizio via env var;
  caricamento bearer token da secrets/core.token o
  CERBERO_BITE_CORE_TOKEN_FILE.

Wrapper:
- clients/macro.py: next_high_severity_within() per filtro entry §2.5.
- clients/sentiment.py: funding_cross_median_annualized() con
  annualizzazione per period nativo per exchange (Binance/Bybit/OKX
  1095, Hyperliquid 8760).
- clients/hyperliquid.py: funding_rate_annualized() per filtro §2.6.
- clients/portfolio.py: total_equity_eur(), asset_pct_of_portfolio()
  per sizing engine + filtro §2.7.
- clients/telegram.py: notify-only (no callback queue, no
  conferme — Bite auto-execute).
- clients/deribit.py: environment_info, index_price_eth,
  latest_dvol, options_chain, get_tickers, orderbook_depth_top3,
  get_account_summary, get_positions, place_combo_order (combo
  atomico), cancel_order.

CLI:
- cerbero-bite ping: health-check parallelo di tutti gli MCP con
  tabella rich (OK/FAIL/SKIPPED).

Docker:
- Dockerfile multi-stage Python 3.13 + uv, user non-root.
- docker-compose.yml con rete external "cerbero-suite", secret
  core_token montato a /run/secrets/core_token, env per ogni MCP.
- secrets/README.md documenta il setup del token.

Documentazione di intervento:
- docs/12-mcp-deribit-changes.md: spec delle modifiche apportate
  al server mcp-deribit (place_combo_order + override testnet via
  DERIBIT_TESTNET).

Dipendenze:
- aggiunto pytest-httpx per i test HTTP.
- rimosso mcp>=1.0 (non usiamo l'SDK MCP, parliamo via HTTP REST).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docker-compose.yml

@@ -0,0 +1,53 @@
+# docker-compose.yml — Cerbero Bite
+#
+# Bite runs in its own Compose project but joins the same Docker
+# network used by Cerbero_mcp so it can resolve `mcp-deribit`,
+# `mcp-macro` and friends by their service name (see the gateway
+# Caddyfile in Cerbero_mcp).
+#
+# The shared network is declared as external here. Create it once on
+# the host with `docker network create cerbero-suite` (or rename the
+# Cerbero_mcp network to `cerbero-suite` and mark it external).
+#
+# Secrets are read from ./secrets/, which is .gitignore'd.
+
+networks:
+  cerbero-suite:
+    external: true
+
+secrets:
+  core_token:
+    file: ./secrets/core.token
+
+volumes:
+  bite-data:
+
+services:
+  cerbero-bite:
+    build:
+      context: .
+      dockerfile: Dockerfile
+    image: cerbero-bite:dev
+    restart: unless-stopped
+    networks: [cerbero-suite]
+    cap_drop: [ALL]
+    security_opt:
+      - no-new-privileges:true
+    secrets:
+      - core_token
+    environment:
+      CERBERO_BITE_CORE_TOKEN_FILE: /run/secrets/core_token
+      # Service URLs — the defaults below match the cerbero-suite
+      # network DNS. Override per service if you need to point at a
+      # different host (dev only).
+      CERBERO_BITE_MCP_DERIBIT_URL: http://mcp-deribit:9011
+      CERBERO_BITE_MCP_HYPERLIQUID_URL: http://mcp-hyperliquid:9012
+      CERBERO_BITE_MCP_MACRO_URL: http://mcp-macro:9013
+      CERBERO_BITE_MCP_SENTIMENT_URL: http://mcp-sentiment:9014
+      CERBERO_BITE_MCP_TELEGRAM_URL: http://mcp-telegram:9017
+      CERBERO_BITE_MCP_PORTFOLIO_URL: http://mcp-portfolio:9018
+    volumes:
+      - bite-data:/app/data
+    # Default command runs the engine status check; override with the
+    # CLI subcommand of choice (start, ping, dry-run, ...).
+    command: ["status"]