feat(mcp): add direct MCP OAuth dynamic client registration

[jhrozek]

Summary

Adds a direct (non-broker) MCP OAuth client mode that uses RFC 7591 Dynamic
Client Registration, so a desktop operator can point mecatl at a protected
Streamable HTTP MCP server with only an endpoint URL — no ToolHive broker,
no manually pasted client ID/secret.

• New client: {mode: dcr, dcr: {}} form for a direct/global MCP OAuth
  profile, separate from the existing broker/preregistered/CIMD forms.
• Discovers RFC 9728 protected-resource + authorization-server metadata,
  dynamically registers a public client, then runs the existing
  authorization-code/PKCE loopback login flow.
• v1 is no-refresh by design: only scopes: [openid] and
  request_refresh_token: false are accepted; an unsolicited refresh token
  fails login before persistence. Resource-bound public-client refresh is
  deferred to Support resource-bound public-client OAuth refresh for direct MCP DCR #1355.
• Durable client registration and the access grant are separate,
  generation-bound, CAS-protected records in the existing encrypted local
  credential store; explicit --reset-dcr-registration /
  --retry-dcr-registration recovery flags cover corrupt/interrupted state.
• Preserves all existing OAuth controller hardening: DNS-pinned/no-proxy
  egress, exact-issuer-origin validation, redacted errors, and rejection of
  the SDK's Basic-auth probe for the restored public client (only the
  parameter-form fallback with the exact client_id is admitted).
• See docs/adr/0325-direct-mcp-dcr.md and
  docs/acceptance/direct-mcp-dcr.md for the full decision record and
  acceptance criteria.

Verification

• task lint && task test green.
• Panel review completed on the branch (fixes folded into the final commit).
• Manual live qualification against connector-gateway.stacklok.dev/gw/mcp
  with real browser consent: registration, login, tool discovery/call, and
  credential reuse across a mecatui restart all verified. Post-expiry
  login-required and re-login/registration-reuse verification is in
  progress and will be confirmed before merge.

Fixes: #1265

🤖 Generated with Claude Code