feat: add MCP OAuth mode (GITLAB_MCP_OAUTH=true)

[titouanmathis]

Problem

When deploying this MCP server for a team using a self-hosted GitLab instance, there is no way for multiple users to authenticate with their own GitLab accounts without each one manually generating a Personal Access Token and configuring it in their MCP client. This is friction-heavy, hard to manage at scale, and breaks when tokens expire.

This PR adds a GITLAB_MCP_OAUTH=true mode that enables the MCP spec OAuth flow: users authenticate directly with GitLab through their MCP client's browser flow, tokens are managed per session on the server, and no pre-registered GitLab OAuth application or manual token management is required.

How it works

1. User adds the MCP server URL in their MCP client (e.g. Claude.ai)
2. Client discovers OAuth endpoints via /.well-known/oauth-authorization-server
3. Client registers itself via Dynamic Client Registration (POST /register) — proxied to GitLab's open DCR endpoint; no pre-registration needed
4. Client redirects the user's browser to the GitLab login page
5. User authenticates; GitLab redirects back to the client's callback URL
6. Client sends Authorization: Bearer <token> on every MCP request
7. Server validates the token against GitLab's /oauth/token/info and stores it per session

All existing auth modes (REMOTE_AUTHORIZATION, GITLAB_USE_OAUTH, PAT, cookie) are completely unchanged.

Configuration

docker run -d \
  -e STREAMABLE_HTTP=true \
  -e GITLAB_MCP_OAUTH=true \
  -e GITLAB_API_URL="https://gitlab.example.com/api/v4" \
  -e MCP_SERVER_URL="https://your-mcp-server.example.com" \
  -p 3002:3002 \
  zereight050/gitlab-mcp

Claude.ai config — no headers needed:

{
  "mcpServers": {
    "GitLab": {
      "url": "https://your-mcp-server.example.com/mcp"
    }
  }
}

Variable	Required	Description
GITLAB_MCP_OAUTH	Yes	Set to true to enable
MCP_SERVER_URL	Yes	Public HTTPS URL of your MCP server
GITLAB_API_URL	Yes	GitLab instance API URL
STREAMABLE_HTTP	Yes	Must be true (SSE not supported)
MCP_DANGEROUSLY_ALLOW_INSECURE_ISSUER_URL	No	true for local HTTP dev only