feat: Phase 1 P1 — Dockerfile, AGNTCY alignment docs, Node.js SDK

Three remaining Phase 1 P1 deliverables:

1. Dockerfile — multi-stage build (builder + production), node:18-alpine,
   non-root USER node, .dockerignore excluding secrets and dev artifacts

2. AGNTCY alignment docs (docs/agntcy/) — README and alignment.md mapping
   all 6 AGNTCY domains to AgentIdP features with Phase 2/3 pending items noted

3. Node.js SDK (@sentryagent/idp-sdk) — TypeScript strict, zero any, native
   fetch (Node 18+), TokenManager with 60s auto-refresh, service clients for
   all 14 endpoints (agents, credentials, tokens, audit), AgentIdPError typed
   error hierarchy, full README

All three changes tracked under openspec/changes/ with tasks marked complete.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

openspec/changes/nodejs-sdk/proposal.md

@@ -0,0 +1,13 @@
+## Why
+Bedroom developers currently must write raw HTTP calls to use AgentIdP. A Node.js SDK removes that friction — developers install one package and get a fully typed, auto-authenticating client. This is a Phase 1 P1 deliverable and a core developer experience improvement.
+
+## What Changes
+- New `sdk/` directory at project root containing a self-contained TypeScript npm package
+- `AgentIdPClient` class: handles auth, token refresh, and exposes typed methods for all 14 endpoints
+- Covers all four services: AgentRegistry, Credentials, Token, AuditLog
+- Full TypeScript types — zero `any`, strict mode
+- Published as `@sentryagent/idp-sdk` (package name)
+
+## What Does Not Change
+- No API changes
+- No changes to the main application source