Revert "feat: remove MCP servers"

This reverts commit a9ff78b494.

claude/Dockerfile

@@ -30,6 +30,28 @@ COPY settings.json /etc/claude-code/managed-settings.json
 RUN curl -fsSL https://claude.ai/install.sh | bash -s stable
 
 
+# Install MCP servers globally — entry points land in /usr/local/lib/node_modules/
+RUN npm install -g \
+  @modelcontextprotocol/server-github \
+  @yoda.digital/gitlab-mcp-server \
+  @aashari/mcp-server-atlassian-jira \
+  @aashari/mcp-server-atlassian-confluence
+
+# Patch transitive CVEs bundled inside MCP server node_modules:
+#   CVE-2025-66414, CVE-2026-0621 — @modelcontextprotocol/sdk <1.25.2
+#   CVE-2026-33671               — picomatch <4.0.4
+RUN for pkg_dir in \
+      /usr/local/lib/node_modules/@modelcontextprotocol/server-github \
+      /usr/local/lib/node_modules/@yoda.digital/gitlab-mcp-server \
+      /usr/local/lib/node_modules/@aashari/mcp-server-atlassian-jira \
+      /usr/local/lib/node_modules/@aashari/mcp-server-atlassian-confluence; do \
+    [ -d "$pkg_dir" ] && \
+      cd "$pkg_dir" && \
+      npm install --no-audit --no-fund \
+        @modelcontextprotocol/sdk@1.25.2 \
+        picomatch@4.0.4 \
+      || true; \
+  done
 
 # Workspace and Claude config dir — owned by the built-in node user (uid 1000).
 # Pre-creating ~/.claude ensures the named volume is initialised with the