fix: enforce external OAuth token context

[FreeOnePlus]

Summary

• validate external OAuth access tokens with trusted RFC 7662 introspection before userinfo
• enforce active, issuer, audience/resource, lifetime, subject, and required-scope checks while retaining only configured scopes
• send the RFC 8707 resource indicator on authorization-code and refresh requests
• add fail-closed configuration, deployment documentation, and a 2 issuer x 2 resource x 3 scope matrix

Testing

• SEC-007 focused tests: 38 passed
• protocol matrix: 18 passed (10 Streamable HTTP, 6 real subprocess Stdio, 2 multiworker)
• real Doris transport matrix: 4 passed (Streamable HTTP and real subprocess Stdio)
• real Doris cleanup: 0 temporary tables, 0 temporary users
• full pytest: 454 passed, 61 skipped
• uv lock --check, compileall, uv build, wheel/sdist content checks
• new files strict Ruff/format; legacy changed-file baseline has no new findings