Phase 3: MCP HTTP clients + Dockerization

Wrapper async tipizzati sui sei servizi MCP HTTP che Cerbero Bite
consuma in autonomia. 277 test pass, copertura clients 93%, mypy
strict pulito, ruff clean.

Base layer:
- clients/_base.py: HttpToolClient con httpx + tenacity (retry
  esponenziale 3x, timeout 8s, mapping HTTP→eccezioni tipizzate).
- clients/_exceptions.py: McpAuthError, McpServerError, McpToolError,
  McpDataAnomalyError, McpNotFoundError, McpTimeoutError.
- config/mcp_endpoints.py: risoluzione URL via Docker DNS
  (mcp-deribit:9011, ...) con override per servizio via env var;
  caricamento bearer token da secrets/core.token o
  CERBERO_BITE_CORE_TOKEN_FILE.

Wrapper:
- clients/macro.py: next_high_severity_within() per filtro entry §2.5.
- clients/sentiment.py: funding_cross_median_annualized() con
  annualizzazione per period nativo per exchange (Binance/Bybit/OKX
  1095, Hyperliquid 8760).
- clients/hyperliquid.py: funding_rate_annualized() per filtro §2.6.
- clients/portfolio.py: total_equity_eur(), asset_pct_of_portfolio()
  per sizing engine + filtro §2.7.
- clients/telegram.py: notify-only (no callback queue, no
  conferme — Bite auto-execute).
- clients/deribit.py: environment_info, index_price_eth,
  latest_dvol, options_chain, get_tickers, orderbook_depth_top3,
  get_account_summary, get_positions, place_combo_order (combo
  atomico), cancel_order.

CLI:
- cerbero-bite ping: health-check parallelo di tutti gli MCP con
  tabella rich (OK/FAIL/SKIPPED).

Docker:
- Dockerfile multi-stage Python 3.13 + uv, user non-root.
- docker-compose.yml con rete external "cerbero-suite", secret
  core_token montato a /run/secrets/core_token, env per ogni MCP.
- secrets/README.md documenta il setup del token.

Documentazione di intervento:
- docs/12-mcp-deribit-changes.md: spec delle modifiche apportate
  al server mcp-deribit (place_combo_order + override testnet via
  DERIBIT_TESTNET).

Dipendenze:
- aggiunto pytest-httpx per i test HTTP.
- rimosso mcp>=1.0 (non usiamo l'SDK MCP, parliamo via HTTP REST).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/cerbero_bite/clients/telegram.py

@@ -0,0 +1,112 @@
+"""Wrapper around ``mcp-telegram`` (notify-only mode).
+
+Cerbero Bite during the testnet phase (and through the soft launch) is
+fully autonomous: Telegram is used purely to *notify* Adriano of what
+the engine has done, never to gate execution. As a consequence:
+
+* No ``send_with_buttons`` and no callback queue.
+* Confirmation timeouts are handled inside the orchestrator's own
+  state machine, not by waiting on Telegram replies.
+* All notifications go through one of the typed endpoints
+  (``notify``, ``notify_position_opened``, ``notify_position_closed``,
+  ``notify_alert``, ``notify_system_error``) — the formatting lives
+  on the server side.
+"""
+
+from __future__ import annotations
+
+from decimal import Decimal
+from typing import Any
+
+from cerbero_bite.clients._base import HttpToolClient
+
+__all__ = ["TelegramClient"]
+
+
+def _to_float(value: Decimal | float) -> float:
+    return float(value) if isinstance(value, Decimal) else value
+
+
+class TelegramClient:
+    SERVICE = "telegram"
+
+    def __init__(self, http: HttpToolClient) -> None:
+        if http.service != self.SERVICE:
+            raise ValueError(
+                f"TelegramClient requires service '{self.SERVICE}', got '{http.service}'"
+            )
+        self._http = http
+
+    async def notify(
+        self,
+        message: str,
+        *,
+        priority: str = "normal",
+        tag: str | None = None,
+    ) -> None:
+        body: dict[str, Any] = {"message": message, "priority": priority}
+        if tag is not None:
+            body["tag"] = tag
+        await self._http.call("notify", body)
+
+    async def notify_position_opened(
+        self,
+        *,
+        instrument: str,
+        side: str,
+        size: int,
+        strategy: str,
+        greeks: dict[str, Decimal | float] | None = None,
+        expected_pnl_usd: Decimal | float | None = None,
+    ) -> None:
+        body: dict[str, Any] = {
+            "instrument": instrument,
+            "side": side,
+            "size": float(size),
+            "strategy": strategy,
+        }
+        if greeks is not None:
+            body["greeks"] = {k: _to_float(v) for k, v in greeks.items()}
+        if expected_pnl_usd is not None:
+            body["expected_pnl"] = _to_float(expected_pnl_usd)
+        await self._http.call("notify_position_opened", body)
+
+    async def notify_position_closed(
+        self,
+        *,
+        instrument: str,
+        realized_pnl_usd: Decimal | float,
+        reason: str,
+    ) -> None:
+        await self._http.call(
+            "notify_position_closed",
+            {
+                "instrument": instrument,
+                "realized_pnl": _to_float(realized_pnl_usd),
+                "reason": reason,
+            },
+        )
+
+    async def notify_alert(
+        self,
+        *,
+        source: str,
+        message: str,
+        priority: str = "high",
+    ) -> None:
+        await self._http.call(
+            "notify_alert",
+            {"source": source, "message": message, "priority": priority},
+        )
+
+    async def notify_system_error(
+        self,
+        *,
+        message: str,
+        component: str | None = None,
+        priority: str = "critical",
+    ) -> None:
+        body: dict[str, Any] = {"message": message, "priority": priority}
+        if component is not None:
+            body["component"] = component
+        await self._http.call("notify_system_error", body)