feat(mcp): add standard Clerk-backed OAuth

[caio-pizzol]

Summary

• protect the canonical /mcp endpoint with standard OAuth 2.1 and Clerk sign-in
• support OAuth discovery, dynamic client registration, Client ID Metadata Documents, PKCE, resource-bound tokens, refresh, and revocation
• use branded ooxml.dev sign-in, sign-up, and consent pages
• record successful tool calls with the Clerk user ID and dynamic OAuth client ID

Compatibility and cleanup

• serve MCP 2026-07-28 with stateless compatibility for current 2024/2025 clients
• remove the temporary /mcp-v2 route, fixed Clerk client workaround, custom CLI, and beta scripts
• keep /mcp as the only MCP endpoint

Testing

• bun test tests/mcp-server/mcp-auth.test.ts tests/mcp-server/oauth-authorization.test.ts tests/web/auth-navigation.test.ts (23 passing)
• bun run typecheck
• bun run build
• bun run lint (passes with the existing unrelated warning in scripts/ingest-xsd/ingest.ts:34)
• bunx wrangler deploy --dry-run from apps/mcp-server

Production E2E passed after a Wrangler deployment: Codex registered dynamically, completed Clerk sign-in and branded consent, exchanged the code, initialized MCP, discovered the tools, and called ooxml_element for w:p. The usage event was stored with the Clerk user ID, dynamic client ID, tool, and timestamp.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e3bf87c8f8

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[cubic-dev-ai]

All reported issues were addressed across 33 files

<sub>Tip: cubic can generate docs of your entire codebase and keep them up to date. Try it here.

Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 22 files (changes from recent commits).

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>