Add MCP OAuth

Put OAuth 2.1 on the user's MCP server. Then stop.

Guardrails

• MUST use Streamable HTTP. stdio cannot do OAuth.
• MUST keep /.well-known/oauth-protected-resource public.
• MUST return 401 with WWW-Authenticate and resource_metadata on a missing or invalid token. A bare 401 is a host silent-fail.
• MUST call validateToken with the dashboard Server URL as audience.
• MUST register well-known, then Bearer middleware, then the MCP POST. A POST registered first never sees auth.

Gotchas