SDK: design and implement MCP authorization lifecycle ergonomics

Parent story: #1466

Goal

Design and implement an ergonomic TypeScript SDK lifecycle for MCP authorization while preserving the protocol's stateful streaming guarantees.

Design work

• Decide how applications obtain and present the authorization URL.
• Define typed recheck and cancel operations.
• Define how authorization events are streamed and correlated with the initiating request and session.
• Preserve session affinity, cancellation, request options, typed errors, and single-consumption guarantees.
• Define how permission controls and server-denied states are represented without moving authority into the SDK.
• Decide whether the workflow belongs on a namespace or requires a dedicated lifecycle object.

ADR 0304 favors thin namespaces for non-session RPCs and limits new ergonomic resource handles. If the correct design introduces an authorization lifecycle handle, create and accept a superseding ADR before implementation.

Boundaries

• The server remains authoritative for authorization state, permissions, expiry, and terminal outcomes.
• The SDK does not open a browser, render instructions, choose polling/recheck policy, or persist credentials.
• Do not make the TUI phase machine the public SDK contract.

Acceptance criteria

• The design explicitly documents ownership, state transitions, cancellation, affinity, event consumption, and retry/recheck semantics.
• Any conflict with ADR 0304 is resolved through the repository's ADR process before changing the public architecture.
• Applications can complete, recheck, observe, and cancel authorization through a discoverable typed API without raw descriptor calls.
• Concurrent authorization attempts cannot accidentally consume or correlate each other's events.
• Tests cover success, denial, cancellation, disconnect/reconnect behavior where supported, duplicate consumption, and transport parity.
• Public API reports, architecture/user documentation, examples, and the SDK changelog are updated.