feat(lens): add a FerrLens sub-MCP for api.ferrlens.com

[BryanFRD]

Problem

FerrLens ships with a public API at api.ferrlens.com (DNS lookup, SPF/DKIM/DMARC, TLS analysis, SEO checks, dev utilities) and there is no MCP server for it. The repo has one per paid product — vault, track, growth, fleet — and ferrlens already appears in the docs host map (packages/mcp/src/tools/docs.ts:12), so the product is known to this codebase but only as a website to scrape.

Why it matters

The FerrLens tools are the ones an assistant most obviously wants to call mid-conversation: "why is this domain's mail bouncing", "is this cert about to expire", "check the SPF record". They are read-only, fast, and need no destructive-action gating — the cheapest sub-MCP in the set to build and the one with the widest everyday use.

Proposed approach

• New package packages/mcp-lens, same shape as mcp-fleet: api-base.ts resolving FERRLENS_API_URL (default https://api.ferrlens.com), index.ts calling runMcp, tools split by domain.
• First tool set, one per FerrLens tool page: DNS lookup, SPF/DKIM/DMARC check, TLS/certificate analysis, SEO overview.
• Anonymous calls are rate-limited by IP; authenticated calls use the existing getToken() path for the account quota. Both need to work — the free tools should be usable without a FerrLabs login.
• Add it to the Dockerfile package list, the .ferrflow versionedFiles, and the smoke script.

Acceptance criteria

• @ferrlabs/mcp-lens builds, boots, and lists its tools.
• Anonymous use works without a token; authenticated use attaches one when present.
• README documents the server alongside the other four.