Add isolated Navidrome MCP service

config/navidrome-mcp.env.example

@@ -0,0 +1,5 @@
+# Root-only deployment secret. Copy to /etc/mike-ai/navidrome-mcp.env,
+# replace the two placeholders and chmod 600. Never commit the real file.
+NAVIDROME_URL=http://192.168.1.2:4533
+NAVIDROME_USERNAME=REPLACE_WITH_DEDICATED_USER
+NAVIDROME_PASSWORD=REPLACE_WITH_DEDICATED_PASSWORD