Edit authorization is permission-based without ownership checks

Describe the bug
MCP Registry currently uses permission-based authorization for editing servers but does not track or enforce ownership. As a result, any user with matching edit permissions can edit any server, even if they did not create it.
It creates serious risks for multi-tenant or public registry use cases and is not clearly documented.

To Reproduce
Steps to reproduce the behavior:

1. Configure MCP Registry with global edit permissions
2. User A publishes a server
3. User B authenticates with a valid OIDC token
4. User B edits User A’s server, with User A's server name that match the Permission[]
5. Edit request succeeds

Expected behavior

• A user can edit a server only if they are the creator, OR
• The user has explicit admin-level permissions (e.g. *)
• Ownership should be persisted and auditable

Logs
No logs available.

Additional context
Suggested Improvements (High-level)

• Add ownership tracking
• Store created_by (OIDC sub) when a server is published
• Enforce ownership on edits

Allow edit if:

• user is the creator, OR
• user has admin-level permissions (e.g. *)
• Add audit logging

Track:

• who created a server
• who modified it
• timestamps

Start by tracing the server publish and edit request flows, including how the OIDC subject and Permission[] checks are handled. Define how created_by, modifying users, and timestamps are persisted and audited, then verify that creators can edit their servers while only admin-level permissions can edit others.