OAuth sign-in for remote MCP

Interactive MCP clients can sign in with OAuth instead of pasting an API key. Each OAuth profile keeps least-privilege scopes and an optional IP allowlist. API keys remain the way to authenticate the CLI and CI.