0256babc9d
Manual OAuth bearer tokens worked on Console and Connect but were rejected by MCP, which only ran the personal API key middleware. Align MCP with the shared bearer chain used elsewhere: API key, OAuth access token, then identity presence. Drop the local RequireAPIKeyHandler. Add e2e coverage for MCP calls authenticated with a manual OAuth token, including scope enforcement. Signed-off-by: Ludovic Vielle <ludovic@probo.com>