v1.6.3 - Fix OAuth consent rendering

Fixes the OAuth consent screen rendering as blank or garbled in the browser.

The bug

The OAuth authorize endpoint lives at /wp-json/claude-mcp/v1/oauth/authorize — a REST API route. WordPress REST always pipes the response body through wp_json_encode before sending it, even when you set Content-Type: text/html. So my consent-screen HTML was being delivered as a quoted, escaped JSON string. Browsers couldn't render it and the page came up empty (or showed just stray newline characters).

Fix

html_response() and raw_redirect() now call status_header() + header() + echo + exit directly. This bypasses the REST serializer entirely — same pattern already used by the well-known endpoints. The exit terminates the request before WP_REST_Server::serve_request gets a chance to wrap the body.

After updating

The auto-heal routine from 1.6.2 will detect 1.6.3 on next admin pageload. Try the OAuth flow — you'll see the proper consent screen (white card titled "Authorize access") with Approve/Deny buttons.