Add OAuth Bearer token authentication support

[zmofei]

Summary

This PR adds OAuth 2.0 Bearer token authentication to the MCP server. Users can now authenticate requests using Bearer tokens instead of relying only on environment variables.

Changes

• Added OAuth authentication flow to the HTTP server
• Modified tools to accept tokens from authenticated requests
• Tokens passed via Authorization header take precedence over environment variables
• Added comprehensive authentication documentation

Key Features

• Per-request authentication - Each request can use its own Bearer token
• Backwards compatible - Falls back to environment variables if no token provided
• Standards compliant - Follows OAuth 2.0 and RFC specifications
• Multi-tenant ready - Different users can use their own API credentials

Configuration

Set the OAuth server URL via environment variable:

export OAUTH_SERVER_URL=https://your-oauth-server.com

Testing

1. Make a request without authentication to receive OAuth metadata
2. Complete OAuth flow to obtain Bearer token
3. Include token in Authorization header for authenticated requests

Documentation

See AUTH.md for detailed authentication flow and implementation details.

Notes

• Default CORS configuration allows all origins for development
• Update CORS settings for production use
• OAuth server URL must be configured via environment variable