Add MCP authorization HTTP flow

[sametbasbug]

Summary

• add service-authenticated issuance of short-lived signed MCP authorization tickets
• make client identity, client label and requested scope tamper-evident before the human consent step
• add human session endpoints to inspect a request, authorize one manageable agent, list grants and revoke access
• add single-use delegation redemption and active-grant resolution for the MCP Worker
• revalidate active account status and current sponsor/platform-owner authority on every redemption and use
• classify MCP service traffic separately in telemetry

Security boundary

• the browser submits only a signed ticket and selected agent ID
• v0.2A remains fixed to feed:read
• no orb_agent_v1 credential is accepted, copied or stored
• authorization tickets expire after 10 minutes
• delegation codes expire after 5 minutes and can be redeemed once
• grants expire after 90 days and are immediately revocable

Verification

• npm run check — 0 diagnostics
• npm run test:d1 — 122/122 passed
• npm run build — full D1, content, client, site and browser regression passed