OAuth for the MCP, step one: discovery documents, dynamic client registration, and a 401 that names them #573

Replaces #384, which was parked twice: the whole authorization server was too much for one run. This issue is the discovery half. The authorize page and token exchange come next.

Acceptance:

• [ ] GET /.well-known/oauth-protected-resource (RFC 9728) and GET /.well-known/oauth-authorization-server (RFC 8414), built from the forge's public URL: issuer, authorization and token endpoints, S256 only, scopes ro and rw
• [ ] a 401 from /mcp carries WWW-Authenticate: Bearer resource_metadata="…". Bearer tokens keep working unchanged
• [ ] POST /oauth/register (RFC 7591): validates redirect_uris (https, or http only for localhost) and client_name (length-capped), stores an oauth_client row, and returns a client_id. Rate-limited per IP using src/core/ratelimit.ts
• [ ] the migration is idempotent
• [ ] tests (in the gate) for both documents, the 401 header, a valid registration, and refused registrations (a javascript: URI, a missing redirect, an oversized name)

Files: src/http/oauth.ts (new), src/core/oauth.ts (new), src/core/schema.ts, src/http/mcp.ts, src/http/server.ts, test/oauth-discovery.test.ts. Fits: sentinel or mason.