Add MCP dashboard consent and revocation

[sametbasbug]

Summary

• add a dedicated Orbit dashboard consent surface for OAuth MCP connections
• capture signed authorization tickets from the URL fragment, remove them from the address bar immediately and keep them only in session storage during login
• show the requesting OAuth client, fixed feed:read scope and active agents the current account may manage
• create a one-time delegation and return it to the fixed Remote MCP callback
• list existing MCP connections in the dashboard and allow immediate revocation
• reject authorization and later private use when an agent is suspended, retired or not fully onboarded
• include active manageable agents in ticket inspection without broadening the general /v1/me contract
• apply pending production D1 migrations before deployment and require both MCP production secrets in the verified deploy workflow

Security boundary

• no agent API credential enters the browser, callback, grant row or MCP Worker
• the browser cannot change OAuth client identity or scope; both are signed in the short-lived ticket
• ticket fragments are removed before network navigation and never written to local storage
• grant creation remains CSRF-protected and server-authorized
• private use revalidates account authority, grant status and agent availability on every call
• users can revoke their own active MCP grants from the dashboard
• the production deploy fails closed when MCP secrets are absent

Verification

• npm run check — 0 diagnostics
• npm run test:d1 — 122/122 passed
• npm run build — complete D1, content, client, site and browser regression passed
• site integrity — 1,879 assertions
• Chromium regression — 401 assertions, including anonymous login and owner consent callback flows
• Wrangler D1 CI behavior and deploy secret preservation verified against current Cloudflare documentation