M7. MCP authorization (OAuth code flow)

## Why

Today the MCP server relies solely on **origin-header validation** and localhost binding — safe for a single-user local machine, but there is **no authorization layer**. Any **remote, hosted, or shared** agent deployment (team agent, CI runner, cloud-hosted assistant) currently has no supported way to authenticate a caller. The MCP spec defines an **OAuth 2.1 authorization-code flow** for exactly this; adopting it unlocks hosted/agentic scenarios without falling back to master keys.

This is the natural companion to confirmation/elicitation (item M3): authorization answers *"who is allowed to call,"* M3 answers *"what may they do."*

## Proposed behavior

- Implement the MCP **authorization-code flow** for the HTTP transport: advertise the authorization server, validate bearer tokens on each request, and map the authenticated identity onto the shell's existing Entra/RBAC connection so tool calls run with **least-privilege, per-caller** credentials rather than a shared session.
- Keep localhost/no-auth as an explicit opt-in for the current single-user experience.

## Acceptance criteria

- Unauthenticated remote requests are rejected.
- A client can complete the authorization-code flow and call tools with a bearer token.
- Identity flows to the Cosmos/ARM credential.
- Localhost no-auth mode preserved behind a flag.
- Threat model + `docs/mcp.md` updated.

---
_Filed from the Agentic & Automation Roadmap (`docs/agentic-roadmap.md`), item **M7**, Wave 2. Priority P1._

从 docs/mcp.md 和 docs/agentic-roadmap.md 开始，重点查看路线图项目 M7，然后跟踪 HTTP 传输和现有的 Entra/RBAC 凭据路径。完成的标准是：拒绝未经身份验证的远程请求，bearer-token 授权正常工作，身份信息能够传递到 Cosmos/ARM 凭据，localhost 的 no-auth 仍由 flag 控制，并更新威胁模型和文档。

由索引模型根据 Issue 内容生成。