feat: Add mousehole integration for dynamic MAM token management

[masonfox]

Summary

This PR adds optional integration with mousehole for automatic MAM token management, eliminating the need for manual token updates when IP addresses change.

Key Features

• Opt-in Design: Disabled by default, enabled via MOUSEHOLE_ENABLED=true
• Automatic Token Reading: Reads from mousehole's state.json with URL-decoding
• Graceful Fallback: Falls back to static token file if mousehole unavailable
• Read-Only UI: Token Manager shows informative read-only view in mousehole mode
• API Protection: POST/DELETE endpoints blocked to prevent conflicts
• Docker Integration: Shared volume strategy with proper mount configuration
• Comprehensive Documentation: Full setup guide in docs/MOUSEHOLE.md

Changes

• Added MOUSEHOLE_ENABLED and MOUSEHOLE_STATE_FILE environment variables
• Enhanced src/lib/config.js with mousehole token reading and fallback logic
• Updated app/api/mam-token/route.js to support mousehole mode and block editing
• Modified app/components/TokenManager.jsx with conditional read-only UI
• Created docker-compose.mousehole.yml example configuration
• Added comprehensive docs/MOUSEHOLE.md documentation
• Updated README.md with mousehole integration section
• Bumped version to 2.4.0

How It Works

1. Mousehole monitors IP → Updates MAM → Writes state.json
2. Scurry reads state.json → URL-decodes token → Uses for API calls
3. If state.json unavailable → Falls back to secrets/mam_api_token
4. UI shows read-only status with mousehole metadata

Testing Recommendations

• Default behavior (mousehole disabled) remains unchanged
• Mousehole mode with valid state.json reads token correctly
• URL-decoding converts mousehole's encoded format properly
• Fallback activates when state.json is missing
• UI displays read-only view in mousehole mode
• POST/DELETE return 400 errors in mousehole mode
• Docker Compose setup with shared volumes works correctly