Phase 3: MCP HTTP clients + Dockerization

Wrapper async tipizzati sui sei servizi MCP HTTP che Cerbero Bite
consuma in autonomia. 277 test pass, copertura clients 93%, mypy
strict pulito, ruff clean.

Base layer:
- clients/_base.py: HttpToolClient con httpx + tenacity (retry
  esponenziale 3x, timeout 8s, mapping HTTP→eccezioni tipizzate).
- clients/_exceptions.py: McpAuthError, McpServerError, McpToolError,
  McpDataAnomalyError, McpNotFoundError, McpTimeoutError.
- config/mcp_endpoints.py: risoluzione URL via Docker DNS
  (mcp-deribit:9011, ...) con override per servizio via env var;
  caricamento bearer token da secrets/core.token o
  CERBERO_BITE_CORE_TOKEN_FILE.

Wrapper:
- clients/macro.py: next_high_severity_within() per filtro entry §2.5.
- clients/sentiment.py: funding_cross_median_annualized() con
  annualizzazione per period nativo per exchange (Binance/Bybit/OKX
  1095, Hyperliquid 8760).
- clients/hyperliquid.py: funding_rate_annualized() per filtro §2.6.
- clients/portfolio.py: total_equity_eur(), asset_pct_of_portfolio()
  per sizing engine + filtro §2.7.
- clients/telegram.py: notify-only (no callback queue, no
  conferme — Bite auto-execute).
- clients/deribit.py: environment_info, index_price_eth,
  latest_dvol, options_chain, get_tickers, orderbook_depth_top3,
  get_account_summary, get_positions, place_combo_order (combo
  atomico), cancel_order.

CLI:
- cerbero-bite ping: health-check parallelo di tutti gli MCP con
  tabella rich (OK/FAIL/SKIPPED).

Docker:
- Dockerfile multi-stage Python 3.13 + uv, user non-root.
- docker-compose.yml con rete external "cerbero-suite", secret
  core_token montato a /run/secrets/core_token, env per ogni MCP.
- secrets/README.md documenta il setup del token.

Documentazione di intervento:
- docs/12-mcp-deribit-changes.md: spec delle modifiche apportate
  al server mcp-deribit (place_combo_order + override testnet via
  DERIBIT_TESTNET).

Dipendenze:
- aggiunto pytest-httpx per i test HTTP.
- rimosso mcp>=1.0 (non usiamo l'SDK MCP, parliamo via HTTP REST).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tests/unit/test_clients_telegram.py

@@ -0,0 +1,122 @@
+"""Tests for TelegramClient (notify-only mode)."""
+
+from __future__ import annotations
+
+import json
+from decimal import Decimal
+
+import pytest
+from pytest_httpx import HTTPXMock
+
+from cerbero_bite.clients._base import HttpToolClient
+from cerbero_bite.clients.telegram import TelegramClient
+
+
+def _client() -> TelegramClient:
+    http = HttpToolClient(
+        service="telegram",
+        base_url="http://mcp-telegram:9017",
+        token="t",
+        retry_max=1,
+    )
+    return TelegramClient(http)
+
+
+def _request_body(httpx_mock: HTTPXMock) -> dict:
+    request = httpx_mock.get_request()
+    assert request is not None
+    return json.loads(request.read())
+
+
+@pytest.mark.asyncio
+async def test_notify_sends_message_with_priority(httpx_mock: HTTPXMock) -> None:
+    httpx_mock.add_response(
+        url="http://mcp-telegram:9017/tools/notify",
+        json={"ok": True},
+    )
+    await _client().notify("hello", priority="high", tag="entry")
+    body = _request_body(httpx_mock)
+    assert body == {"message": "hello", "priority": "high", "tag": "entry"}
+
+
+@pytest.mark.asyncio
+async def test_notify_default_priority_normal(httpx_mock: HTTPXMock) -> None:
+    httpx_mock.add_response(json={"ok": True})
+    await _client().notify("plain")
+    body = _request_body(httpx_mock)
+    assert body["priority"] == "normal"
+    assert "tag" not in body
+
+
+@pytest.mark.asyncio
+async def test_notify_position_opened_serialises_decimals(
+    httpx_mock: HTTPXMock,
+) -> None:
+    httpx_mock.add_response(
+        url="http://mcp-telegram:9017/tools/notify_position_opened",
+        json={"ok": True},
+    )
+    await _client().notify_position_opened(
+        instrument="ETH-15MAY26-2475-P",
+        side="SELL",
+        size=2,
+        strategy="bull_put",
+        greeks={"delta": Decimal("-0.04"), "vega": Decimal("0.20")},
+        expected_pnl_usd=Decimal("45.00"),
+    )
+    body = _request_body(httpx_mock)
+    assert body["instrument"] == "ETH-15MAY26-2475-P"
+    assert body["greeks"] == {"delta": -0.04, "vega": 0.20}
+    assert body["expected_pnl"] == 45.0
+    assert body["size"] == 2.0
+
+
+@pytest.mark.asyncio
+async def test_notify_position_closed(httpx_mock: HTTPXMock) -> None:
+    httpx_mock.add_response(json={"ok": True})
+    await _client().notify_position_closed(
+        instrument="ETH-15MAY26-2475-P_2350-P",
+        realized_pnl_usd=Decimal("32.50"),
+        reason="CLOSE_PROFIT",
+    )
+    body = _request_body(httpx_mock)
+    assert body == {
+        "instrument": "ETH-15MAY26-2475-P_2350-P",
+        "realized_pnl": 32.5,
+        "reason": "CLOSE_PROFIT",
+    }
+
+
+@pytest.mark.asyncio
+async def test_notify_alert(httpx_mock: HTTPXMock) -> None:
+    httpx_mock.add_response(json={"ok": True})
+    await _client().notify_alert(
+        source="kill_switch", message="armed manually", priority="critical"
+    )
+    body = _request_body(httpx_mock)
+    assert body == {
+        "source": "kill_switch",
+        "message": "armed manually",
+        "priority": "critical",
+    }
+
+
+@pytest.mark.asyncio
+async def test_notify_system_error(httpx_mock: HTTPXMock) -> None:
+    httpx_mock.add_response(json={"ok": True})
+    await _client().notify_system_error(
+        message="deribit feed anomaly",
+        component="clients.deribit",
+    )
+    body = _request_body(httpx_mock)
+    assert body["message"] == "deribit feed anomaly"
+    assert body["component"] == "clients.deribit"
+    assert body["priority"] == "critical"
+
+
+def test_telegram_client_rejects_wrong_service() -> None:
+    bad = HttpToolClient(
+        service="macro", base_url="http://x:1", token="t", retry_max=1
+    )
+    with pytest.raises(ValueError, match="requires service 'telegram'"):
+        TelegramClient(bad)