Bypass Cognito hosted UI when federated IdP is configured

[UsamaSadiq]

Description

MCP OAuth login on production redirects users to Cognito's native username/password page instead of the mPass QR login. The Penpot MCP server (TypeScript) has its own CognitoClient that fetches the authorization_endpoint from Cognito's OIDC discovery doc, which points at Cognito's hosted UI. In our deployment, mpass-auth-proxy sits in front of Cognito and provides the actual login page (mPass QR), but the MCP server bypasses it entirely.

This adds support for a COGNITO_UPSTREAM_AUTH_URL env var that overrides the OIDC-discovered authorization endpoint. config.ts reads the env var into upstreamAuthUrl on MonetaAuthConfig, and cognito.ts uses it (when set) as the base URL for the authorize redirect instead of the discovery document's authorization_endpoint. Token endpoint, JWKS verification, and everything else remain unchanged since mpass-auth-proxy returns real Cognito tokens.

Plane MCP is unaffected as it uses PlaneOAuthProvider (Plane's own OAuth), which already goes through mPass via ForwardAuth.

Testing

• Set COGNITO_UPSTREAM_AUTH_URL=https://auth.<domain>/authorize and verify the MCP OAuth flow redirects to the mPass QR page
• Verify login completes and MCP tools work after authentication
• Verify unset COGNITO_UPSTREAM_AUTH_URL falls back to Cognito's native authorization endpoint