Accept OAuth access tokens on MCP API

Manual OAuth bearer tokens worked on Console and Connect but
were rejected by MCP, which only ran the personal API key
middleware. Align MCP with the shared bearer chain used
elsewhere: API key, OAuth access token, then identity
presence. Drop the local RequireAPIKeyHandler.

Add e2e coverage for MCP calls authenticated with a manual
OAuth token, including scope enforcement.

Signed-off-by: Ludovic Vielle <ludovic@probo.com>

pkg/server/api/mcp/v1/v1_handler.go

@@ -82,7 +82,9 @@ func NewMux(
 
 	r := chi.NewMux()
 	r.Use(authn.NewAPIKeyMiddleware(iamSvc, tokenSecret))
-	r.Handle("/", RequireAPIKeyHandler(logger, protectedHandler))
+	r.Use(authn.NewOAuth2AccessTokenMiddleware(iamSvc))
+	r.Use(authn.NewIdentityPresenceMiddleware())
+	r.Handle("/", protectedHandler)
 
 	logger.Info("MCP server initialized successfully")