fix(docker): point mcp-server at the neo4j service, widen the healthcheck start period

[Irahan2]

Points 1 and 3 of #54. Point 3 came out differently than the issue describes, and point 2 turned
out to be partly stale plus a bigger gap underneath, so I left it out and put the question at the
bottom.

1. NEO4J_URI

Confirmed. Checked from inside the running container:

neo4j:7687     -> reachable
localhost:7687 -> ConnectionRefusedError

mcp-server only read the value from .env, and .env.example ships
bolt://localhost:7687. Added an environment: override for the service name, same as
topwr-api does for MCP_HOST, so it doesn't depend on what's in someone's .env. Verified the
environment block beats env_file when both set the key.

Left .env.example alone on purpose, bolt://localhost:7687 is the right address for
just mcp-server on the host.

3. Healthcheck start_period

Raised 15s to 180s as asked, but the ~4 minutes didn't reproduce here. I took the whole stack
down and brought it back up cold with the URI fix in place:

container started : 09:51:51.9
port 8005 open    : 09:51:57.4   -> 6.0s
health log        : one failure inside the start period, healthy from the next check

So on this machine the old 15s was already enough. My guess is the 4 minutes you saw was the
first point: with localhost the Neo4j driver retries before giving up, and the server can't
bind until initialize_rag() returns. Worth re-checking on your side after this lands.

I still went with 180s because the cost is one-sided. A successful check ends the start period
immediately, so headroom never slows a healthy container down, it only delays reporting one that
never comes up. If we'd rather detect a dead mcp-server sooner we can bring it down, the
measurement is in the compose comment.

2. Prefect, and a question

I didn't touch this one. Two things I found while checking it:

The version half is already done. Dockerfile.prefect doesn't pin prefect==2.* any more, it
runs uv sync --locked off pyproject.toml + uv.lock, which resolves to prefect 3.6.11.

The part that isn't done is bigger than the issue says. The container never runs the scheduled
deployment at all:

• the image's CMD is only prefect server start
• compose.prefect.yml doesn't override it
• nothing anywhere calls serve_refresh / uv run prefect-refresh

So the cron from #51 only exists when someone runs just refresh-serve on their own machine.
CLAUDE.md also points at docker/prefect-entrypoint.sh ("starts Prefect server then runs
pipeline") and that file isn't in the repo.

And even if we wire the deployment in, compose.prefect.yml is a separate stack with no neo4j
service and no link to mcp_network, so the pipeline has no route to the graph.

That last bit is a deployment decision rather than a fix, so: how do you want the two stacks to
relate? Options I can see are a shared external network, folding prefect into compose.stack.yml,
or keeping them separate and giving the pipeline its own Neo4j address. Happy to do whichever,
just don't want to pick for you.

I did correct the two stale CLAUDE.md claims here since I'd verified them, gotcha 9 now describes
the real gap. Shout if you'd rather that moved to the follow-up PR.

[Dominik-Galus]

lgtm