feat(mcp-gateway): enterprise SSO OAuth gateway for MCP services

## Summary

Build an MCP Gateway capability for enterprise SSO/OAuth login and routing authenticated users to the corresponding MCP server or service.

## Goal

Allow an enterprise user to authenticate through the configured identity provider, select or access an authorized MCP server, and have the gateway forward the request with a verified identity and scoped authorization context.

## Scope

- Support OIDC/OAuth 2.0 login with configurable enterprise identity providers.
- Handle authorization-code flow, callback validation, token exchange, refresh, logout, and session expiry.
- Validate issuer, audience, redirect URI, state, nonce, PKCE, and token signatures.
- Map SSO claims (subject, email, groups, roles, tenant/team) to MCP Runtime identity and access grants.
- Route authenticated requests to the corresponding MCP server/service.
- Prevent cross-tenant or cross-server identity and token leakage.
- Provide clear authentication and authorization errors for MCP clients.
- Add configuration, audit events, operational documentation, and automated tests.

## Acceptance criteria

- [ ] An enterprise user can complete an OIDC/OAuth login through the MCP Gateway.
- [ ] The gateway validates the callback and establishes a secure session or token context.
- [ ] Authorized users can reach only the MCP servers allowed by their mapped grants/claims.
- [ ] The corresponding MCP service receives the verified user identity and scoped context.
- [ ] Unauthenticated, expired, invalid, and unauthorized requests fail closed.
- [ ] Tokens and credentials are not exposed in logs, browser URLs, or upstream requests.
- [ ] Login, logout, token refresh, routing, and deny paths have automated coverage.
- [ ] Deployment configuration and enterprise IdP setup documentation are included.

## Open design questions

- Which IdP providers and claim mappings should be supported first?
- Should MCP clients use browser-based login, device authorization, or both?
- Should upstream MCP services receive a gateway-issued identity token, verified headers, or mTLS identity?