Add Supabase OAuth authentication (passthrough mode)

[Adriansillo]

Summary

• Add OAuth support via Supabase using FastMCP's passthrough mode (enableTokenSwap: false), so MCP clients receive the raw Supabase JWT directly — no server-side token storage, meaning server restarts don't invalidate sessions
• Hybrid authenticate handler supports three auth methods: plain API key header, ?token= query param, and Supabase JWT (decoded to resolve Browserless API key via PostgREST)
• Fetch interceptor overrides Supabase's 60s token TTL to 1 hour to prevent constant refresh cycles
• New account-resolver module with 5-min cache for JWT → API key resolution
• tsconfig.json updated to Node16 module resolution to support fastmcp/auth package exports
• All existing tests updated with new OAuth config fields; new tests for account-resolver

Test plan

• npm run build — no type errors
• npm test — all tests pass
• Deploy to test environment with OAuth env vars, verify OAuth flow completes via VS Code
• Verify plain API key auth still works: Authorization: Bearer <api-key>
• Verify ?token= query param auth still works
• Restart MCP server — verify OAuth clients reconnect without re-authenticating

🤖 Generated with Claude Code

[andyMrtnzP]

Interesting. Why 16 specifically?

[Adriansillo]

fastmcp uses Node16 subpath exports (fastmcp/auth), and the old "moduleResolution": "node" can't resolve them. Without this change, import { OAuthProvider } from 'fastmcp/auth' fails to compile.