starting new version, after released

Signed-off-by: Avelino <[email protected]>

Bump rand from 0.9.2 to 0.9.3

Bumps [rand](https://github.com/rust-random/rand) from 0.9.2 to 0.9.3.
- [Release notes](https://github.com/rust-random/rand/releases)
- [Changelog](https://github.com/rust-random/rand/blob/0.9.3/CHANGELOG.md)
- [Commits](rust-random/rand@rand_core-0.9.2...0.9.3)

---
updated-dependencies:
- dependency-name: rand
  dependency-version: 0.9.3
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <[email protected]>

Add community and contributor guidelines

Signed-off-by: Avelino <[email protected]>

Add multi-stage Dockerfile and built-in healthcheck

The Dockerfile required a pre-built binary and the compose file
referenced a nonexistent Dockerfile.dev. The health check ran
`mcp serve --help` which always exits 0 regardless of server state.

Replace with a multi-stage build (rust:alpine to scratch) that compiles
from source and produces an 11.8MB image. Add `mcp healthcheck [url]`
subcommand so scratch images can probe /health without external tools.

Fixes: #65
Fixes: #66
Fixes: #73

Signed-off-by: Avelino <[email protected]>

Fix review issues on ACL decision audit and CL

Signed-off-by: Avelino <[email protected]>

Fix review issues: bidirectional audit toggle, empty path guard, Comp…

…ose escaping

Signed-off-by: Avelino <[email protected]>

 Update docs to reflect resources/prompts dispatch and ACL enforcement

Signed-off-by: Avelino <[email protected]>

Fix deny grant scoping and strict mode edge cases

PR review caught that deny grants ignored the access level — a deny
with access=read was blocking write calls to the same tool. Also,
access="*" bypassed strictClassification for ambiguous tools, and
schema detection silently fell to legacy when roles/subjects had the
wrong JSON type.

Deny grants now only fire when their access level matches the tool's
classification. Strict mode blocks ambiguous tools regardless of
access level. Schema detection triggers on key presence (not type),
so malformed configs fail loudly. Subjects referencing unknown roles
are rejected at config load time.

Signed-off-by: Avelino <[email protected]>

Address PR review: fix cache key, flag validation, and save durability

Signed-off-by: Avelino <[email protected]>