bug: OAuth ignores authorization_servers from Protected Resource Metadata

### Summary

Q CLI's MCP OAuth implementation ignores the `authorization_servers` field from the Protected Resource Metadata (PRM) and derives OAuth endpoints from the MCP server's origin instead. This breaks authentication for MCP servers using external authorization servers.

### Expected Behavior (per MCP OAuth spec)

1. Q CLI fetches PRM → gets `authorization_servers: ["https://external-idp.example.com"]`
2. Q CLI uses external IDP's `/authorize` endpoint ✅

### Actual Behavior

1. Q CLI fetches PRM → gets `authorization_servers: ["https://external-idp.example.com"]`
2. **Q CLI IGNORES `authorization_servers`** ❌
3. Q CLI derives `/authorize` from MCP server's ORIGIN (same host)

### Reproduction

1. Configure MCP server returning PRM with external authorization_servers
2. Add to Q CLI config
3. Observe OAuth URL uses MCP server origin, not external IDP

### Technical Analysis

In `crates/chat-cli/src/mcp_client/oauth_util.rs`, rmcp constructs OAuth endpoints relative to MCP server origin. The `authorization_servers` field from PRM is never used.

`OAuthConfig` only supports `redirect_uri` - no `authUrl`/`tokenUrl` override.

### Impact

- Breaks MCP servers using external authorization servers
- Affects enterprise deployments with custom IDPs
- May relate to #3431 (Figma OAuth)

### Proposed Fix

1. Parse `authorization_servers` from PRM
2. Use first entry as base URL for OAuth endpoints
3. Add `authUrl`/`tokenUrl` to `OAuthConfig`

### Reference

- MCP OAuth spec: https://modelcontextprotocol.io/specification/2025-03-26/basic/authentication

Beginne in crates/chat-cli/src/mcp_client/oauth_util.rs und verfolge, wie rmcp OAuth-Endpunkte erstellt, nachdem Protected Resource Metadata abgerufen wurde. Untersuche OAuthConfig und die Verarbeitung von authorization_servers, und reproduziere das anschließend mit einem PRM, das einen externen Authorization Server benennt. Erledigt ist die Aufgabe, wenn die OAuth-Autorisierungs- und Token-Endpunkte diesen Server anstelle des Ursprungs des MCP-Servers verwenden.

Vom Indexierungsmodell aus dem Issue-Text verfasst.