M7. MCP authorization (OAuth code flow)

## Why

Today the MCP server relies solely on **origin-header validation** and localhost binding — safe for a single-user local machine, but there is **no authorization layer**. Any **remote, hosted, or shared** agent deployment (team agent, CI runner, cloud-hosted assistant) currently has no supported way to authenticate a caller. The MCP spec defines an **OAuth 2.1 authorization-code flow** for exactly this; adopting it unlocks hosted/agentic scenarios without falling back to master keys.

This is the natural companion to confirmation/elicitation (item M3): authorization answers *"who is allowed to call,"* M3 answers *"what may they do."*

## Proposed behavior

- Implement the MCP **authorization-code flow** for the HTTP transport: advertise the authorization server, validate bearer tokens on each request, and map the authenticated identity onto the shell's existing Entra/RBAC connection so tool calls run with **least-privilege, per-caller** credentials rather than a shared session.
- Keep localhost/no-auth as an explicit opt-in for the current single-user experience.

## Acceptance criteria

- Unauthenticated remote requests are rejected.
- A client can complete the authorization-code flow and call tools with a bearer token.
- Identity flows to the Cosmos/ARM credential.
- Localhost no-auth mode preserved behind a flag.
- Threat model + `docs/mcp.md` updated.

---
_Filed from the Agentic & Automation Roadmap (`docs/agentic-roadmap.md`), item **M7**, Wave 2. Priority P1._

Bắt đầu với docs/mcp.md và docs/agentic-roadmap.md, đặc biệt là mục M7 trong roadmap, sau đó lần theo HTTP transport và đường dẫn credential Entra/RBAC hiện có. Hoàn tất nghĩa là các request từ xa không được xác thực bị từ chối, authorization bằng bearer token hoạt động, identity đến được Cosmos/ARM credentials, no-auth trên localhost vẫn được kiểm soát bằng flag, và threat model cùng tài liệu được cập nhật.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.