v0.3.0 — OAuth admin collections under MCP + adminAccess

Fixes the OAuth admin UI being unreachable

The 0.2.0 lockdown (#33) locked oauth-clients/oauth-tokens to read: () => false, which also removed them from the admin nav and 404'd their routes. The intended replacement custom views never worked under Payload v3 (wrong prop contract, no nav links, gated on a role field the default Users collection lacks).

What changed

• OAuth Clients and OAuth Tokens are now native admin collections under the MCP nav group (beside the MCP plugin's API Keys).
• New overridable adminAccess option gates read/update/delete. Default: authenticated users in your userCollection. create stays denied; the public REST/GraphQL surface stays closed. oauth-auth-codes and oauth-csrf-nonces remain hidden and locked.
• The plugin no longer registers custom admin components, so generate:importmap is no longer required. The v3-incompatible ClientsView/TokensView exports are repaired and marked @deprecated.
• Docs updated (README, INSTALL_FOR_AGENTS, threat model); install-test hardened.

Breaking / behavioral (why minor)

• New adminAccess public option; changed default access on the two collections; removed the ClientsViewProps/TokensViewProps type exports.
• Mixed-role apps: if your userCollection contains untrusted end-users, pass a stricter adminAccess (e.g. ({ req }) => req.user?.role === 'admin').

Full diff: #44