test: bind-mount container config files instead of streaming via archive

[BorisTyshkevich]

Summary

testcontainers' `Files: []ContainerFile{...}` abstraction injects host files into containers by tar-streaming them through Docker's `PUT /containers/{id}/archive` endpoint (the same endpoint backing `docker cp`). Some hardened sandbox environments intentionally block that endpoint to prevent arbitrary binary injection into running containers.

This PR replaces the two call sites with read-only bind mounts via `HostConfigModifier.Binds`. Bind mounts are wired up at container-create time through `POST /containers/create` (already allowed), and the file content reaches the container via the kernel's mount machinery rather than a Docker API tar stream.

Change

Two test files, ~30 LoC net:

File	Change
`pkg/server/oauth_e2e_test.go` (`setupAntalyaClickHouseWithOIDC`)	Files were already on disk (`tokenProcessorFile`, `startupScriptsFile`). Moved them from `Files:` to `hc.Binds`.
`cmd/altinity-mcp/main_test.go` (`TestTestConnection/connection_with_tls`)	Inputs were in-memory string `Reader`s. Materialized to `t.TempDir()` via a small `writeTmp` helper, then bind-mounted. Added the `docker/docker/api/types/container` import.

Both call sites use `:ro` to preserve the read-only intent of the original config injection.

Why this is portable

Behavior is identical in environments where `PUT /containers/{id}/archive` is allowed. Bind mounts work in plain Docker, Docker Desktop, Colima, Lima, Podman, etc. — the change neither tightens nor loosens the security envelope outside the sandbox case it fixes.

Test plan

• `go vet ./...` — clean
• `TESTCONTAINERS_RYUK_DISABLED=true go test ./cmd/altinity-mcp/ -run 'TestTestConnection/connection_with_tls' -count=1` — pass
• `TESTCONTAINERS_RYUK_DISABLED=true go test ./pkg/server/ -run 'TestOAuthE2EWithMockOIDC|TestOAuthOpenAPIFullFlow' -count=1` — pass
• Full sandbox suite (`TESTCONTAINERS_RYUK_DISABLED=true go test ./...`) green; was previously failing only on these three subtests due to the archive-endpoint block.
• Verified no other tests use `testcontainers.ContainerFile`, `CopyToContainer`, `CopyFileToContainer`, or `CopyDirToContainer` — the two call sites here are complete coverage.

Scope

• Test-only change. No production-code change. No new dependencies.
• Independent of any feature branch — based directly on `main`.

🤖 Generated with Claude Code