feat(mcp): per-requester OAuth for MCP servers (#122166)

Per-requester OAuth for HTTP MCP servers: in shared channels each trusted sender connects their own account. New config: mcp.servers.<name>.oauth.identity ("shared" default, byte-identical behavior) and gateway.publicOrigin (HTTPS except loopback) for the new GET /oauth/mcp/callback served on the Gateway HTTP server. Requester tokens are isolated per (channel, account, sender) in mcp_oauth_stores rows (no schema bump); callbacks correlate through a durable state-keyed one-time index with a 10-minute TTL; per-requester servers are fail-closed out of static/scheduled runtimes; unauthenticated senders get a sign-in link with a portable URL button; MCP config mutations clear requester credentials at the canonical owner. mcp status --json keeps the legacy authStatus fields additively. Proven by a two-user self-hosted-Executor E2E through the real gateway callback. Part of #122034.

Co-authored-by: Ayaan Zaidi <hi@obviy.us>

docs/.generated/plugin-sdk-api-baseline/command-status.json

@@ -1 +1 @@
-{"contentHash":"76208ba5171dd1ab3bc1fe54cf3deb6e1464e5478934e4c969ec6003e7e47493","entrypoint":"command-status","importSpecifier":"openclaw/plugin-sdk/command-status"}
+{"contentHash":"5ad0b6ccf41bee6a0c14d18886815fcfdae46c74f4fe6d4a1b694236f4c8cf9d","entrypoint":"command-status","importSpecifier":"openclaw/plugin-sdk/command-status"}