Add remote MCP with browser OAuth

[bluebird42]

What changes

Adds a hosted remote MCP endpoint to Core at /mcp, intended for https://api.mave.io/mcp. Clients can connect through the existing Mave sign-in flow, choose a space, and approve read-only or explicitly requested write access. The consent screen reuses the CLI authentication card; Connected apps lets users revoke access immediately.

• Stateless Streamable HTTP with ten video/collection tools based on mave-cli, using Core's existing tenant-scoped contexts. Destructive calls require explicit confirmation arguments.
• Browser OAuth with discovery, dynamic public-client registration, S256 PKCE, resource-bound credentials, hashed tokens, refresh rotation/replay detection, and current membership checks. Existing API keys remain private.
• An official-SDK remote client example, protocol interoperability test, and configuration/connection documentation.

Rollout

Deploy through the normal Core release and migration process. The migration adds three MCP tables. Set MAVE_MCP_RESOURCE_URL=https://api.mave.io/mcp and route the API discovery/OAuth paths documented in docs/mcp.md; the dashboard serves authorization and connection management. No separate MCP service is required. This PR does not deploy the endpoint.

The transport supports MCP 2025 Streamable HTTP with JSON responses; it does not advertise SSE subscriptions or the 2026 envelope protocol. Local file uploads and Vimeo migration remain CLI operations.

Validation

• Full Core suite: 1,218 tests passed with disposable PostgreSQL, ClickHouse and MinIO.
• Official SDK interoperability: passed HTTP initialization, tool listing/execution and OAuth discovery/registration.
• Browser smoke test: completed login, consent, callback and token exchange; the example client listed its read-only tools and the connection appeared in Connected apps.
• mix credo --strict, mix precommit, mix security.enforce, JavaScript syntax checks and npm audit passed.
• CI now runs the SDK interoperability test alongside the full suite.