Bootstrap MCP OAuth

Replace API-key MCP auth with the goodviews OAuth 2.1 + PKCE stack: the token is bound to one account MCP URL, Inspector discovers the authorization server from RFC 9728 metadata, and GET still requires Bearer.

This skill does not scaffold ExMCP HTTP or a generic OAuth provider. Those are /bootstrap-mcp and /boruta bootstrap.

Keep Cors-less native ExMCP transport, VaryOrigin, CacheBody, and the Bandit SSE wrapper from /bootstrap-mcp. Overlay auth, routes, and identity.

Prerequisites

Verify before writing files: