v1.2.0

Operational hardening.

• Graceful shutdown: the HTTP server and the per-request MCP transports are
  closed on SIGTERM/SIGINT instead of being dropped.
• Timing-safe bearer token comparison, via crypto.timingSafeEqual rather
  than ===.
• release.yml now gates the image build on lint and tests. Previously a tag
  built and published without running either.
• Container healthcheck in docker-compose for the /health endpoint, using
  node rather than curl since node:22-slim has no curl.
• The server version is read from package.json instead of being hardcoded,
  which fixes real drift: a deployment was observed reporting serverInfo
  1.0.0 while running the 1.0.1 image.
• MAX_ENTRIES_WARN default raised from 300 to 1000, matching what real
  deployments were already overriding it to.

Also fixes the test configuration: 'timeout' is not a vitest option and was
silently ignored, so the suite had always run under the 5s default instead
of the intended 30s. It is now testTimeout, with hookTimeout raised
alongside it. Agent worktrees under .claude/ are excluded from test
discovery, so a bare npm test no longer runs one copy of the suite per
worktree against the same Valkey.

49 tests passing, lint clean.