Design OAuth core extraction boundary

[jmrGrav]

Summary

• documents a minimal internal/oauthcore extraction boundary
• separates reusable OAuth policy from oauthproxy reverse-proxy behavior
• keeps /authorize operator-only by default
• defers public/shared module creation until both repos validate the boundary

Reviewer Guide

Context

This PR prepares the OAuth extraction work required before hugo-public-mcp can integrate optional OAuth safely. It is deliberately a design PR only: the implementation remains in issue #6 after review.

Key decisions

• Start with an internal internal/oauthcore boundary, not a new public module.
• Keep oauthproxy as the HTTP/reverse-proxy adapter.
• Keep reverse-proxy behavior, backend token injection, backend URL handling, and response mutation out of oauthcore.
• Keep /authorize operator-only by default.
• Do not modify hugo-public-mcp in this extraction step.

Intentionally not implemented

• No OAuth extraction code yet.
• No runtime behavior change.
• No public shared module.
• No public /authorize mode.
• No fake OIDC, JWKS, revocation, refresh-token, or scanner-only endpoints.
• No production deployment, tag, or release.

Reviewer focus

• Confirm that the proposed oauthcore boundary is small enough to extract incrementally.
• Confirm that proxy-only behavior is excluded from reusable core code.
• Confirm that the extraction order preserves existing runtime behavior and tests.
• Confirm that issue Implement minimal reusable OAuth core extraction #6 should remain open for the implementation after this design is merged.

Risks

• Extracting too much at once could regress the existing OAuth proxy.
• Letting proxy concepts enter oauthcore would make reuse by hugo-public-mcp brittle.
• ACL extraction depends on the scope-to-tool work landing cleanly first.

Related issue

Related to #6. This PR should not close #6; the implementation work remains open after design review.

Validation

• go test ./...
• gitleaks detect --no-banner --redact --source .
• GitHub checks are green on the PR.

Production impact

Design only. No runtime behavior change, no production deployment, no tag, no release.