Add MCPGW OIDC env vars to ECS task definition, tfvars, and Helm charts

## Background

PR #849 added optional OIDC/OAuth support to the MCPGW server (`servers/mcpgw/server.py`). The Python code reads these env vars via `os.getenv()` with safe defaults (feature disabled when unset):

| Env Var | Default | Container |
|---------|---------|-----------|
| `OIDC_ENABLED` | `""` (disabled) | mcpgw |
| `OIDC_CLIENT_ID` | `"mcp-gateway-web"` | mcpgw |
| `OIDC_CLIENT_SECRET` | `""` | mcpgw |
| `KEYCLOAK_INTERNAL_URL` | `"http://keycloak:8080"` | mcpgw |
| `KEYCLOAK_EXTERNAL_URL` | `"http://localhost:18080"` | mcpgw |
| `KEYCLOAK_REALM` | `"mcp-gateway"` | mcpgw |
| `M2M_CLIENT_ID` | `"mcp-gateway-m2m"` | mcpgw |
| `M2M_CLIENT_SECRET` | `""` | mcpgw |
| `MCPGW_BASE_URL` | `"http://localhost:18003"` | mcpgw |
| `REGISTRY_API_TOKEN` | `""` | mcpgw |

These vars currently exist ONLY in:
- `servers/mcpgw/server.py` (lines 38-51)
- `.env.example` (with a warning about issue #895)

They are NOT wired into any infrastructure config.

## What Needs to Be Added

### ECS (Terraform)
- `terraform/aws-ecs/modules/mcp-gateway/ecs-services.tf`: Add env vars to the mcpgw container definition (both Fargate and EC2 service blocks). Use Secrets Manager for `OIDC_CLIENT_SECRET`, `M2M_CLIENT_SECRET`, and `REGISTRY_API_TOKEN`.
- `terraform/aws-ecs/modules/mcp-gateway/variables.tf`: Add corresponding Terraform variables
- `terraform/aws-ecs/terraform.tfvars.example`: Add commented-out example entries

### Helm (if applicable)
- Add to `values.yaml` with sensible defaults (OIDC disabled)
- Mount secrets via Kubernetes Secrets, not plaintext in values

### Docker Compose
- `docker-compose.yml`: Add env vars to the `mcpgw-server` service (lines 454-466). Currently only `HOST`, `PORT`, and `REGISTRY_BASE_URL` are set.

## IMPORTANT: Blocked by #895

Do NOT implement this issue until #895 (security gaps in MCPGW OAuth/M2M) is resolved. Adding infrastructure wiring before the security fix would make it easy to accidentally enable a feature with known identity propagation gaps.

The recommended approach: implement this as part of the same PR that resolves #895, so the security fix and the deployment wiring ship together.

## Acceptance Criteria

- [ ] Issue #895 is resolved first
- [ ] MCPGW OIDC env vars added to ECS task definition (Fargate and EC2 blocks)
- [ ] Secrets (`*_SECRET`, `*_TOKEN`) use AWS Secrets Manager, not plaintext env vars
- [ ] Terraform variables and tfvars.example updated
- [ ] Docker Compose mcpgw-server service updated
- [ ] Helm chart updated (if charts exist for mcpgw)
- [ ] `OIDC_ENABLED` defaults to `false` in all infrastructure configs
- [ ] Tested: ECS deployment with `OIDC_ENABLED=false` shows no behavioral change