feat(mcp): wire oauth-provider + jwt plugins behind MCP_ENABLED

Adds `jwt()` and `oauthProvider()` (with single `mcp:full` scope, dynamic
client registration enabled, custom consent page at /oauth/consent) to the
better-auth plugin array, gated on env.MCP_ENABLED so existing behaviour is
unchanged when the flag is off.

Regenerates auth-schema.ts to include jwks, oauth_client, oauth_access_token,
oauth_refresh_token, and oauth_consent tables. Migration 0014_tan_sunspot adds
only new tables/FKs — no existing tables altered or dropped.

Also adds the Nitro server route at
/.well-known/oauth-authorization-server/api/auth (RFC 8414 discovery path for
issuer /api/auth) since Nuxt 4's [...] catch-all does not route dotfile-style
paths; delegates to oauthProviderAuthServerMetadata() from @better-auth/oauth-provider.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: Ripwords