docs(spec): MCP OAuth server design

Per-user OAuth via better-auth oauth-provider plugin, exposing tickets
and full report context (screenshot, console/network logs, replay
transcript) to AI clients over MCP Streamable HTTP. Read + safe writes
gated by existing permissions.ts; no new auth surface, no service
tokens. Replay events reduced server-side to a textual timeline.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: Ripwords