tools: add physics-sanity + Docker MCP scaffolding + tools/README

- tools/physics-sanity/ — JS library of cross-node balance helpers
  (mass / hydraulic / hydraulic-power / oxygen-transfer / energy) with
  7 unit tests + a CLI demo. Designed for `require()` from per-node
  integration tests where shape-based unit tests miss physically-
  impossible plant states.
- tools/docker-compose.yml + tools/mcp/{node-red-admin,influxdb,browser}
  scaffolding — placeholder Dockerfiles + a ROADMAP.md for the Node-RED
  admin MCP. Compose file is the target shape for the Q3-2026 migration
  to the central MCP server; the per-service Dockerfile stays in this
  repo as the canonical definition either way. Implementations are TODO.
- tools/README.md — top-level tooling index; documents the CI order for
  running every tool on a PR.
- .gitignore: ignore tools/.env (developer-specific MCP endpoints).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tools/mcp/node-red-admin/ROADMAP.md

@@ -0,0 +1,50 @@
+# mcp-node-red-admin — implementation roadmap
+
+Status: placeholder. Compose entry exists, server impl is TODO.
+
+## Goal
+
+An MCP stdio server that wraps the Node-RED admin HTTP API, exposing the
+following tools to Claude Code:
+
+| Tool | Wraps | Use case |
+|---|---|---|
+| `node_red_get_flows` | `GET /flows` | Read deployed flow JSON |
+| `node_red_post_flow` | `POST /flow/:id` (single tab) | Deploy one tab without nuking others |
+| `node_red_replace_flows` | `POST /flows` (bulk) | Replace the entire flow set |
+| `node_red_inject` | `POST /inject/:nodeId` | Fire an inject node by id |
+| `node_red_list_nodes` | `GET /nodes` | Discover registered node types |
+| `node_red_restart_flow` | `DELETE` + redeploy | Force a restart of one tab |
+
+## Sketch
+
+```js
+// tools/mcp/node-red-admin/server.mjs
+import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+
+const NODE_RED_HOST = process.env.NODE_RED_HOST;
+const TOKEN = process.env.NODE_RED_TOKEN;
+
+const server = new Server({ name: 'evolv-node-red-admin', version: '0.1.0' }, { capabilities: { tools: {} } });
+server.setRequestHandler(/* listTools */);
+server.setRequestHandler(/* callTool — fetch NODE_RED_HOST + tool's endpoint */);
+await server.connect(new StdioServerTransport());
+```
+
+## Dockerfile sketch
+
+```dockerfile
+FROM node:20-alpine
+WORKDIR /app
+COPY package.json server.mjs ./
+RUN npm install
+CMD ["node", "server.mjs"]
+```
+
+## When to build it
+
+After we've shipped enough EVOLV flow work that "deploy + fire inject +
+read state in one turn" becomes the dominant inner loop. Today the
+`curl` pattern still works for one-off deploys; the MCP earns its
+keep when the loop runs 5+ times per session.