feat(mcp): enable account OAuth and Cloudflare HTTP deployment

[mrgoonie]

Account OAuth clients can discover the NLB authorization server and call MCP tools with scoped access tokens. The Worker validates identity and resource claims, then sends short-lived user delegation assertions to the web API while preserving public reads, static-token clients, and stdio.

This adds stateless Streamable HTTP support and deployable Cloudflare configuration with separate staging and production resources. OAuth is enabled in configuration; deploy the web provider, migration, and environment-specific secrets before the MCP Worker. The documentation covers authentication, client setup, rollout, and rollback.

Validation:

• Toolkit: 91 tests, typecheck, build, and Wrangler dry-run passed locally. The nine OAuth tests also pass on Node 18.20.8 using its real WebCrypto implementation in the Worker test environment.
• Matching web provider: 115 tests, typecheck, and Worker build passed; independent review completed.
• Staging provider and MCP discovery verified live during rollout.
• Staged files checked for credential patterns and ignored local secret values; rollout plans and local secrets excluded.
• Repository CI must pass its existing Node 18/20/22 and Linux/Windows/macOS matrix before merge.