Refactor reusable OAuth core primitives

[jmrGrav]

Summary

• adds internal/oauthcore as the first reusable OAuth boundary
• moves pure OAuth models, metadata builders, RFC error mapping, token hashing, and anonymous MCP tool policy into oauthcore
• keeps oauthproxy as the HTTP/proxy adapter through type aliases and small adapter calls
• preserves existing runtime behavior and public HTTP shape
• adds an explicit legacy/default proxy regression test for the hugo-mcp-go auth dependency

Compatibility guardrail

mcp-runtime-go is still used by hugo-mcp-go for auth. This PR must not reorient or break that runtime.

This PR does not change:

• env var names or defaults
• ANONYMOUS_ENABLED=false default behavior
• bearer-required proxy behavior when anonymous mode is disabled
• /mcp proxy routing
• backend Authorization: Bearer <HUGO_TOKEN> injection
• HUGO_MCP_URL, HUGO_HOST, or HUGO_TOKEN semantics
• OAuth endpoints exposed by oauthproxy
• token storage files, SQLite schema, or migration behavior

Scope

This is the first implementation slice for #6. It intentionally extracts only low-risk primitives and pure policy logic.

Extracted:

• authorization server metadata builder
• protected resource metadata builder
• OAuth request/response/domain models
• RFC 6749 authorize/token error mapping
• anonymous MCP JSON-RPC allowlist policy
• token hash helper and generic token store interface

Intentionally not included

• no production deployment
• no behavior change
• no public shared module
• no changes to hugo-public-mcp
• no public /authorize change
• no fake OIDC/JWKS/revocation/refresh endpoints
• no full state-machine migration yet; auth-code/token lifecycle remains in oauthproxy.Service

Reviewer Guide

Focus on whether oauthcore remains generic and free of proxy-only concepts. In particular, it should not know about backend URLs, Hugo host/token injection, reverse proxy paths, or response mutation.

Also verify the new TestHandleProxy_LegacyDefaultOAuthProxyBehaviorUnchanged contract:

• anonymous requests are still rejected by default
• valid bearer tokens still proxy to the configured Hugo backend
• backend bearer token injection remains unchanged
• backend host/path rewriting remains unchanged

Validation

• go test ./...
• go test -race ./...
• go vet ./...
• gitleaks detect --no-banner --redact --source .

golangci-lint run ./... was also attempted and currently reports pre-existing repository-wide errcheck/staticcheck issues outside the scope of this extraction. This PR does not add a new golangci configuration or broad lint cleanup.

Production impact

None. This is an internal refactor with tests. No tag, no release, no deploy.

Refs #6