feat: implement MC domain filter proxy, API, dashboard

- proxy: asyncio TCP proxy with handshake parser, domain whitelist,
  transparent backend tunneling, SQLite logging, mtime hot reload
- api: FastAPI routes for config/domains/logs/status + restart trigger
- frontend: React + Vite NPM-style dashboard (dashboard/domains/logs/settings)
- nginx: reverse proxy for /api -> api:8000 and / -> frontend:3000
- docker-compose: full stack with shared data volume
- replace spec mc-domain-filter.md with README.md

api/config_io.py

@@ -0,0 +1,43 @@
+"""API 측 config IO 헬퍼.
+
+프록시와 동일한 파일을 가리키고, atomic rename 으로 갱신해서 프록시가
+mtime polling 으로 안전하게 hot reload 할 수 있게 한다.
+"""
+from __future__ import annotations
+
+import json
+import os
+import threading
+from pathlib import Path
+
+CONFIG_PATH = Path(os.environ.get("MC_CONFIG_PATH", "/data/config.json"))
+LOG_DB = Path(os.environ.get("MC_LOG_DB", "/data/logs.db"))
+
+DEFAULT_CONFIG = {
+    "proxy": {"listen_port": 25565, "enabled": True},
+    "backend": {"host": "127.0.0.1", "port": 25565},
+    "allowed_domains": [
+        {"domain": "mc.tkrmagid.kr", "enabled": True, "note": "메인 도메인"}
+    ],
+}
+
+_lock = threading.Lock()
+
+
+def load_config() -> dict:
+    if not CONFIG_PATH.exists():
+        CONFIG_PATH.parent.mkdir(parents=True, exist_ok=True)
+        save_config(DEFAULT_CONFIG)
+        return json.loads(json.dumps(DEFAULT_CONFIG))
+    with _lock:
+        with CONFIG_PATH.open("r", encoding="utf-8") as f:
+            return json.load(f)
+
+
+def save_config(cfg: dict) -> None:
+    CONFIG_PATH.parent.mkdir(parents=True, exist_ok=True)
+    tmp = CONFIG_PATH.with_suffix(".json.tmp")
+    with _lock:
+        with tmp.open("w", encoding="utf-8") as f:
+            json.dump(cfg, f, ensure_ascii=False, indent=2)
+        os.replace(tmp, CONFIG_PATH)