feat: social-mcp 初始实现

多平台社交自动化 MCP 服务，首批支持小红书。

- 13 个 MCP 工具：登录管理、内容浏览、发布、互动
- 13 个 REST API 端点，支持 Bearer token 认证和限流
- BrowserManager：串行队列、背压、崩溃恢复
- Cookie 持久化：原子写入、0600 权限
- 安全：DNS rebinding 防御、错误脱敏、深层日志 redact
- Docker 部署支持
- 28 个单元测试全部通过

Dockerfile

@@ -0,0 +1,89 @@
+# =============================================================================
+# Stage 1: Builder
+# =============================================================================
+
+FROM node:22-slim AS builder
+
+# Enable corepack for pnpm
+RUN corepack enable && corepack prepare pnpm@latest --activate
+
+WORKDIR /app
+
+# Copy package manifests first (layer caching for dependency install)
+COPY package.json pnpm-lock.yaml ./
+
+# Install all dependencies (including devDependencies for building)
+RUN pnpm install --frozen-lockfile
+
+# Copy source code
+COPY tsconfig.json tsup.config.ts ./
+COPY src/ src/
+
+# Build the project
+RUN pnpm build
+
+# Remove devDependencies to slim down node_modules for production
+RUN pnpm prune --prod
+
+# =============================================================================
+# Stage 2: Production
+# =============================================================================
+
+FROM node:22-slim
+
+# Install Chromium dependencies required by Playwright/rebrowser-playwright
+# These are the shared libraries Chromium needs to run in headless mode.
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    libnss3 \
+    libnspr4 \
+    libatk1.0-0 \
+    libatk-bridge2.0-0 \
+    libcups2 \
+    libdrm2 \
+    libdbus-1-3 \
+    libxkbcommon0 \
+    libxcomposite1 \
+    libxdamage1 \
+    libxfixes3 \
+    libxrandr2 \
+    libgbm1 \
+    libpango-1.0-0 \
+    libcairo2 \
+    libasound2 \
+    libatspi2.0-0 \
+    libwayland-client0 \
+    fonts-noto-cjk \
+    && rm -rf /var/lib/apt/lists/*
+
+# Create non-root user
+RUN groupadd --gid 1001 appuser \
+    && useradd --uid 1001 --gid appuser --shell /bin/sh --create-home appuser
+
+WORKDIR /app
+
+# Copy built artifacts and production dependencies from builder
+COPY --from=builder --chown=appuser:appuser /app/dist ./dist
+COPY --from=builder --chown=appuser:appuser /app/node_modules ./node_modules
+COPY --from=builder --chown=appuser:appuser /app/package.json ./package.json
+
+# Create data directory for cookies and API token
+RUN mkdir -p /home/appuser/.social-mcp \
+    && chown -R appuser:appuser /home/appuser/.social-mcp
+
+# Switch to non-root user
+USER appuser
+
+# Environment defaults
+ENV NODE_ENV=production \
+    HOST=0.0.0.0 \
+    PORT=3000 \
+    HEADLESS=true \
+    COOKIE_DIR=/home/appuser/.social-mcp \
+    ALLOW_REMOTE=yes-i-understand-the-risk
+
+EXPOSE 3000
+
+HEALTHCHECK --interval=30s --timeout=5s --retries=3 --start-period=10s \
+    CMD node -e "fetch('http://localhost:3000/health').then(r => process.exit(r.ok ? 0 : 1)).catch(() => process.exit(1))"
+
+CMD ["node", "dist/index.js"]