Implement minimal reusable OAuth core extraction

[jmrGrav]

Goal

Implement the minimal reusable OAuth component boundary documented in PR #7, without changing existing mcp-runtime-go runtime behavior.

Design reference:

• PR Design OAuth core extraction boundary #7: Design OAuth core extraction boundary
• docs/OAUTHCORE_EXTRACTION_DESIGN.md

Scope

Extract reusable candidates incrementally behind an internal boundary, starting with internal/oauthcore:

• OAuth authorization server metadata builders
• OAuth protected resource metadata builders
• Dynamic Client Registration models/validation
• Authorization Code + PKCE service logic
• token endpoint models/errors
• token storage interface and existing SQLite adapter compatibility
• request IP/trusted proxy helpers
• redirect URI validation
• audit redaction patterns
• scope-to-tool ACL after related ACL work is stable

Non-goals

• No production cutover
• No behavior change for existing mcp-runtime-go deployments
• No public shared module yet
• No changes to hugo-public-mcp in this issue
• No fake JWKS/OIDC/revocation/refresh endpoints
• No public /authorize behavior change

Acceptance criteria

• Existing public HTTP behavior remains compatible
• Existing OAuth tests keep passing
• New oauthcore tests cover extracted pure logic
• Proxy-specific behavior stays in oauthproxy
• No backend URL/token/path fields enter the reusable core config
• go test ./..., go test -race ./..., go vet ./..., and secret scanning pass

[jmrGrav]

Design PR #7 is merged. Reopening this issue because the implementation work remains: extract the minimal reusable OAuth components behind an internal oauthcore boundary without changing runtime behavior.

[jmrGrav]

Handled by the canonical unified repo migration. The runtime extraction is no longer tracked in this source repo.