mcp-config: run MCP servers client-side, not on the gateway

Every API worth exposing (Gitea, Proxmox) is user-scoped, so hosting MCP
centrally means one shared token per server: everyone acts as the same
identity and attribution is lost. LiteLLM's per-request BYOK cannot cover
all of them either -- it builds its tool->server map from a headerless
background listing, and gitea-mcp hard-exits without a token, so it never
registers. A split brain (some MCPs server-side, some client-side) is worse
than either, so all of them move client-side.

Servers are declared local, spawned via npx with pinned versions, and read
each user's OWN credentials via {env:VAR}. No token is ever written to the
config; the file stays identical for every user.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

README.md

@@ -89,6 +89,14 @@ Variables modules look for:
   only on a box without mcp-sync.
 - `OP_SERVICE_ACCOUNT_TOKEN` — 1Password service-account token for
   non-interactive `op read` / `op run`.
+- `GITEA_KEY`, `PROXMOX_MCP_TOKEN_ID`, `PROXMOX_MCP_TOKEN_SECRET` — **your own**
+  credentials for the client-side MCP servers in `mcp-config/`. opencode reads
+  them from your environment (`{env:VAR}`) and passes them to the MCP server it
+  spawns, so the tools act as *you*. Keep them in `~/.zshrc.local`; they are
+  never written into any config file.
+
+  These are NOT used by `ai-k8s-iac` / `task up`: the LiteLLM gateway hosts no
+  MCP servers and stores no MCP credentials. See `mcp-config/README.md`.
 
 Secrets never go in this repo or in `zsh/zshrc` — that file is shared
 config applied to every box.