feat: add MCP server instance OAuth URL route

[hbanerjee74]

What

Adds a per-user, instance-scoped OAuth-URL route to the MCP server-instances API:

GET /api/mcp-server-instances/{mcp_server_instance_id}/oauth-url

It resolves the instance, enforces that the caller owns it (Spec.UserID == req.User.GetUID()), resolves the underlying server + config, and returns CheckForMCPAuth(...) as:

{ "oauthURL": "<authorize-url>" }   // user must complete OAuth
{ "oauthURL": "" }                  // authorized, or server uses no OAuth

Changes (3 files, +32/−6):

• pkg/api/handlers/serverinstances.go — new ServerInstancesHandler.GetOAuthURL; mcpOAuthChecker MCPOAuthChecker threaded into the handler + NewServerInstancesHandler.
• pkg/api/router/router.go — wire oauthChecker into the constructor and register the route alongside the other instance routes.
• pkg/api/authz/resources.go — authz entry for the new path.

Why

The existing MCPHandler.GetOAuthURL is server-scoped (…/servers/{mcp_server_id}/oauth-url). Studio's per-user MCP setup needs to know whether a specific user's instance still requires authorization, keyed by instance.Name (the canonical per-instance mcpID). This route is the instance-scoped analogue, modeled directly on the server-scoped handler.

Studio consumes it for the user-setup lifecycle (startOAuth and the per-row OAuth-status probe-and-cache): an empty oauthURL flips the stored per-user oauth_connected flag to true; a non-empty URL is opened for the user to authorize.

Downstream dependency

The Studio branch feat/add-user-mcp-server (accelerate-data/vd-studio) depends on this route. This PR must merge and a new Obot image must be published before the Studio user OAuth-completion flow works end to end — until then Studio validates that path only at the contract/unit level.

Safety gate (re-verified in this checkout)

CreateServerInstance binds instances to a catalog v1.MCPServer via mcpServerID; ListServersFromAllSources returns catalog server projections with CatalogEntryID / Configured / MissingOAuthCredentials; ACR matching is resource-scoped. No SystemMCPServer → MCPServer bridge exists in the instance-creation path. This route adds no new family coupling.

Verification

• go build ./... — OK
• go test ./pkg/api/handlers ./pkg/api/router — 239 passed

Note / follow-up

No Go unit test is added for GetOAuthURL in this PR (the existing suite passes but does not exercise the new handler directly). Happy to add a handler test for the ownership check + the empty-vs-URL response shaping if preferred before merge.