docs(plan): MCP OAuth server — Phase 5

Targeted fix-up phase closing the four critical gaps from the post-ship
audit (rate limit, allowlist refresh, RFC 9728 discovery, stale Phase 1
test) plus the negative test suite spec §10 promised. Catalog drift
items deferred. 6 tasks, ~3 hours.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: Ripwords