MCP OAuth, part 2: authorize with consent and a PKCE token exchange that mints the same ro/rw forge token #1616

Replaces the rest of #384.

Done looks like

• [ ] GET /oauth/authorize needs a forge session (a signed-out visitor goes through sign-in and comes back). It shows a server-rendered consent page with the client's name escaped, a choice of ro or rw, and a token name. The consent POST is same-origin and returns a single-use code that expires in 60 seconds.
• [ ] POST /oauth/token checks the code, the redirect URI and the S256 verifier, then mints the same token the Settings page mints. /mcp accepts that token unchanged, and it shows in Settings' token list, where it can be revoked.
• [ ] Tests run the full flow with a registered client. They also cover a wrong verifier, a reused code, an expired code, a cross-origin consent POST, and checking that an ro token cannot write. Each new test file is listed in GATE.
• [ ] The README says how to attach the Claude app (callback https://claude.ai/api/mcp/auth_callback) and Grok.

Files: src/oauth/, the token action Settings uses, test/.