v0.2.7 — OAuth authentication for each supplied request

OAuth authentication now evaluates the exact PSR-7 request passed to the MCP authenticator. A shared authenticator can process a valid bearer token, a missing or invalid token, and another caller's token independently. This also covers ordinary RequestInterface instances used by custom adapters.

The optional OAuth integration requires naf/oauth-server 0.2.6 or later; Composer excludes older combinations. OAuth remains optional for applications using the default file-token driver. Applications using OAuth should update both packages together. No schema migration is required by this correction.

The development lock now uses released OAuth Server 0.2.6 and Framework 0.2.12, so CI executes the supplied-request HTTP regression instead of skipping it with the previous Framework lock. Validation includes 16 tests / 92 assertions, strict Composer validation, style checks and CI on PHP 8.3 and 8.5. Regression coverage checks explicit PSR-7 requests and sequential authenticated, missing-token and invalid-token calls through POST /mcp.