[impuls42]

Adds a "Recommended setup" section to the README, between the quick starts and
"How frames stay fresh".

The quick starts show the shortest thing that works. Nothing said what to run if
you want it to keep working, so the non-obvious choices — the ones the live
hardware testing turned up — were only recorded in the frame-freshness deep dive
or in comments in docker-compose.yml, where nobody setting the thing up for the
first time will look.

Documentation only; no code, no behaviour change.

What it covers

A compose file to copy, then the reasoning for each choice that isn't obvious:

• A Linux host with a real V4L2 device — not a preference. Docker Desktop on
  macOS and Windows cannot see a webcam and fails outright on the device mapping.
• CAM2IP_LAZY=true — the counter-intuitive one, since it makes cold grabs
  ~450ms slower. It buys the device being released when nobody is subscribed:
  cam2ip cannot serve a stale frame at all, an unplug/replug self-heals in under
  a second instead of needing a container restart, and the indicator light goes
  off when nobody is looking.
• A /dev/v4l/by-id/ device path — devices: resolves once at
  container-create, so after a replug the container points at a minor number the
  kernel has moved on from. The by-id symlink follows the device, so a plain
  restart finds it. The /dev bind-mount alternative is mentioned with its cost
  (every device on the machine) rather than recommended.
• Streamable HTTP when unattended, stdio when a desktop client launches it —
  warm stream (~10ms vs ~700ms grabs), and the restart policy and healthcheck
  only mean something in HTTP mode.
• Publishing on 127.0.0.1 from the host side, while leaving the in-container
  bind at its 0.0.0.0 default — the two are separate questions and only the
  first is the security boundary. Docker forwards a published port to the
  container's bridge address, not its loopback, so binding the server to
  127.0.0.1 inside the container makes it unreachable from the host — quietly,
  because the healthcheck runs inside the container against loopback, passes,
  and leaves docker ps reporting healthy. The section also notes the
  consequence: a server not bound to loopback gets no automatic Host allowlist
  from mcp, so MCP_ALLOWED_HOSTS is the knob once the publish widens past
  loopback — and it becomes required outright the moment MCP_ALLOWED_ORIGINS
  is set, since origins alone leaves an empty host allowlist that rejects
  everything.
• Ports through .env so both sides move together, and a pinned sha-
  tag rather than latest.

Then two subsections:

• Leave the frame settings alone — the defaults drop 7 frames per reconnect
  against a queue that holds 4. Lists the only three reasons to touch them, and
  notes uvcvideo was measured granting exactly the buffer count requested at
  every value from 1 to 32, so raising MCP_WARMUP_FRAMES buys nothing there.
• Monitoring — watch camera_status → state, not the container
  healthcheck. The healthcheck deliberately never touches the camera, because
  probing a frame would dequeue one and wake the device every interval, defeating
  CAM2IP_LAZY. An unplugged camera therefore leaves the container healthy and
  both of camera_status's connection booleans true; state is what reads
  connected_but_no_frames.

Verification

• CI green on the first revision: test, image-smoke and build-and-push all
  passed. The follow-up revision touches only README.md.
• The recommended YAML snippet was extracted and run through
  docker compose config, which confirms it resolves to host_ip: 127.0.0.1 on
  both publishes and to an environment: block that sets no bind address
• docker compose config on the repo's own docker-compose.yml still parses
• The #on-macos cross-reference resolves, the /dev bind-mount notes referred
  to do exist in docker-compose.yml, and every env var named
  (CAM2IP_LAZY, MCP_WARMUP_S, MCP_WARMUP_FRAMES, MCP_STREAM_IDLE_S,
  MCP_ALLOWED_HOSTS, MCP_ALLOWED_ORIGINS) is one the code actually reads