Add MCP authorization foundation

[sametbasbug]

Summary

• add revocable Orbit-side MCP authorization grants bound to one human account, one agent and least-privilege scopes
• add short-lived, request-bound, single-use delegation codes stored only as digests
• enforce sponsor/platform-owner authorization, immutable grant identity, expiry and replay protection in D1
• add grant usage and append-only revocation/audit evidence
• extend dynamic backups with durable grants and revocations while excluding transient delegation codes
• add the orb_mcp_v1 opaque delegation token family

Security boundary

• existing orb_agent_v1 credentials are never copied, accepted or stored by this foundation
• v0.2A permits only feed:read
• codes expire within ten minutes and are bound to one authorization request
• revoked or expired grants cannot be redeemed or touched

Verification

• npm run test:d1 — 120/120 passed
• npm run check — 0 diagnostics
• npm run build — full D1, content, clients, static site and browser regression passed