Add mcp-master binary and build target

New cmd/mcp-master/ entry point following the agent pattern:
cobra CLI with --config, version, and server commands.

Makefile: add mcp-master target, update all and clean targets.
Example config: deploy/examples/mcp-master.toml with all sections.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

deploy/examples/mcp-master.toml

@@ -0,0 +1,94 @@
+# MCP Master configuration
+#
+# Default location: /srv/mcp-master/mcp-master.toml
+# Override with: mcp-master server --config /path/to/mcp-master.toml
+
+# ------------------------------------------------------------------
+# gRPC server
+# ------------------------------------------------------------------
+[server]
+# Listen address for the gRPC server. Bind to the Tailnet interface.
+grpc_addr = "100.95.252.120:9555"
+tls_cert  = "/srv/mcp-master/certs/cert.pem"
+tls_key   = "/srv/mcp-master/certs/key.pem"
+
+# ------------------------------------------------------------------
+# Database
+# ------------------------------------------------------------------
+[database]
+path = "/srv/mcp-master/master.db"
+
+# ------------------------------------------------------------------
+# MCIAS (for validating inbound CLI/agent tokens)
+# ------------------------------------------------------------------
+[mcias]
+server_url   = "https://mcias.metacircular.net:8443"
+ca_cert      = "/srv/mcp-master/certs/ca.pem"
+service_name = "mcp-master"
+
+# ------------------------------------------------------------------
+# Master identity (for dialing agents)
+# ------------------------------------------------------------------
+[master]
+# Path to the MCIAS service token file used by the master to
+# authenticate to agents when forwarding deploys and edge routes.
+service_token_path = "/srv/mcp-master/mcias-token"
+
+# CA cert for verifying agent TLS certificates.
+ca_cert = "/srv/mcp-master/certs/ca.pem"
+
+# ------------------------------------------------------------------
+# Edge routing
+# ------------------------------------------------------------------
+[edge]
+# Public hostnames in service definitions must fall under one of these
+# domains. Validation uses proper domain label matching.
+allowed_domains = ["metacircular.net", "wntrmute.net"]
+
+# ------------------------------------------------------------------
+# Agent registration
+# ------------------------------------------------------------------
+[registration]
+# MCIAS service identities permitted to register.
+allowed_agents = ["agent-rift", "agent-svc", "agent-orion"]
+
+# Maximum registered nodes.
+max_nodes = 16
+
+# ------------------------------------------------------------------
+# Timeouts
+# ------------------------------------------------------------------
+[timeouts]
+deploy       = "5m"
+edge_route   = "30s"
+health_check = "5s"
+undeploy     = "2m"
+snapshot     = "10m"
+
+# ------------------------------------------------------------------
+# DNS (MCNS)
+# ------------------------------------------------------------------
+[mcns]
+server_url = "https://mcns.svc.mcp.metacircular.net:8443"
+ca_cert    = "/srv/mcp-master/certs/ca.pem"
+token_path = "/srv/mcp-master/mcns-token"
+zone       = "svc.mcp.metacircular.net"
+
+# ------------------------------------------------------------------
+# Logging
+# ------------------------------------------------------------------
+[log]
+level = "info"
+
+# ------------------------------------------------------------------
+# Bootstrap nodes
+# ------------------------------------------------------------------
+[[nodes]]
+name    = "rift"
+address = "100.95.252.120:9444"
+role    = "master"
+
+[[nodes]]
+name    = "svc"
+address = "100.106.232.4:9555"
+role    = "edge"