2.0.11 — upload is a save, and discovery without credentials

Generates Oracle DAO, SOAP and MCP server code from a config file. This is the source drop for
2.0.11; the running article is the container image.

docker pull ghcr.io/srmadscience/mcpdbwizard:2.0.11

What is new in 2.0.11

Uploading a config now saves it, and a deployment can adopt one from a file at boot.

Upload used to load the JSON into the editor and say "Use Save to keep it". So an uploaded config
was invisible on the Runtime page, absent from the access matrix, and gone at the next restart —
while the Design page showed it as the current config, so it looked present in the one place anybody
was looking. Somebody uploading a config file is stating that they want that config here. The save
path also does more than write the file: it copies the SQL library into the config's own scope and
stamps the deployment's Oracle connection.

/.well-known/** answers without credentials.

Discovery happens before a client has credentials, by construction: /.well-known/* is where an MCP
client looks to find out how it is meant to authenticate (RFC 9728 protected-resource metadata, RFC
8414 authorization-server metadata), so putting it behind authentication is circular.

The failure this prevents is worse than a 401. Under form login the entry point answered a probe
with a 302 to /login; the client followed it, got a page of HTML with 200 OK, and reported a
parse error — so "this deployment does not offer OAuth" arrived as a malformed-response bug
several layers from its cause.