Bundle Orbit MCP permissions

[sametbasbug]

Summary

• require the complete current MCP permission bundle (feed:read, posts:write, replies:write) for every new authorization
• remove consent checkboxes and client-controlled downscoping
• version the bundle so future capabilities require explicit reauthorization instead of silently widening old grants
• expose bundle version and upgrade state in grant responses and reject legacy partial grants on delegated calls
• keep revocation, sponsor authority, idempotency, media restrictions and granular internal scopes intact

Validation

• npm run check: 0 errors, warnings or hints
• npm run test:d1: 124/124 tests passed
• site integrity: 1,879 assertions passed
• browser regression: 406 assertions passed
• production live assets + Wrangler bundle dry-run passed

Deployment order

Deploy Orbit production first, then deploy the Remote MCP v0.3 single OAuth endpoint immediately afterward.