Install the [mcp] extra in the production Docker image

## Summary

`Dockerfile.prod` installs `.[livekit]` only. Production validation errors if `MCP_SERVERS_CONFIG` is set without the `mcp` package. Known-limitations tells operators to pip-install by hand inside the image.

## Context

- `Dockerfile.prod` (`pip install -e ".[livekit]"`)
- `src/voxforge/infrastructure/security/production.py` (import mcp check)
- `docs/release/known-limitations.md`
- Related docs issue #16 (FAQ). This issue is the image fix.

## Acceptance criteria

- [ ] Prod image includes `mcp` (or a documented build-arg defaulting on)
- [ ] `MCP_SERVERS_CONFIG` no longer fails the import check in a stock prod build
- [ ] Known-limitations MCP note updated
- [ ] docker-build CI still green

Do not pull MCP servers at runtime in CI.

Start with Dockerfile.prod and compare its pip install extras with the import check in src/voxforge/infrastructure/security/production.py. Review the MCP note in docs/release/known-limitations.md, then run the docker-build CI validation without pulling MCP servers at runtime. Done means a stock production image passes the MCP_SERVERS_CONFIG import check, the limitation is updated, and CI remains green.

Written by the indexing model from the issue text.