mcp-config: run MCP servers client-side, not on the gateway

Every API worth exposing (Gitea, Proxmox) is user-scoped, so hosting MCP
centrally means one shared token per server: everyone acts as the same
identity and attribution is lost. LiteLLM's per-request BYOK cannot cover
all of them either -- it builds its tool->server map from a headerless
background listing, and gitea-mcp hard-exits without a token, so it never
registers. A split brain (some MCPs server-side, some client-side) is worse
than either, so all of them move client-side.

Servers are declared local, spawned via npx with pinned versions, and read
each user's OWN credentials via {env:VAR}. No token is ever written to the
config; the file stays identical for every user.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

mcp-config/opencode.gateway.json

@@ -12,12 +12,25 @@
     }
   },
   "mcp": {
-    "covert-gpt": {
-      "type": "remote",
-      "url": "https://llm.covert-gpt.com/mcp/",
+    "gitea": {
+      "type": "local",
+      "command": ["npx", "-y", "gitea-mcp@0.0.10"],
       "enabled": true,
-      "headers": {
-        "Authorization": "Bearer {env:LITELLM_KEY}"
+      "environment": {
+        "GITEA_HOST": "https://git.nic-oconnor.com",
+        "GITEA_ACCESS_TOKEN": "{env:GITEA_KEY}"
+      }
+    },
+    "proxmox": {
+      "type": "local",
+      "command": ["npx", "-y", "proxmox-mcp-server@0.2.0"],
+      "enabled": true,
+      "environment": {
+        "PROXMOX_HOST": "https://prox-01.covert-cloud.com:8006",
+        "PROXMOX_TOKEN_ID": "{env:PROXMOX_MCP_TOKEN_ID}",
+        "PROXMOX_TOKEN_SECRET": "{env:PROXMOX_MCP_TOKEN_SECRET}",
+        "PROXMOX_INSECURE_TLS": "true",
+        "PVE_READONLY": "false"
       }
     }
   },