Feature/oauth 2.1 support

[westonbrown]

OAuth 2.1 Authentication Integration for MCP Gateway

• Adds comprehensive OAuth 2.1 authentication with support for AWS Cognito, Okta, and generic OAuth providers
• Implements fine-grained scope-based authorization with server-level and tool-level access control
• Maintains full compatibility with both SSE and StreamableHTTP transport protocols
• Provides secure session management with JWT validation and PKCE support

Features

🔐 Multi-Provider OAuth 2.1 Support

• AWS Cognito: Full implementation with group-based permissions
• Okta: Complete integration with tenant-based authentication
• Generic OAuth: Configurable for any OAuth 2.1 compliant provider
• PKCE Security: Authorization code flow with Proof Key for Code Exchange

🎯 Granular Access Control

• Registry permissions: mcp:registry:admin, mcp:registry:read
• Server permissions: mcp:server:{name}:execute, mcp:server:{name}:toggle
• Tool permissions: mcp:server:{name}:tool:{tool}:execute
• Automatic group-to-scope mapping from identity provider groups

🚀 Full Protocol Compatibility

• SSE Transport: /api/execute/{service} endpoints with streaming support
• StreamableHTTP: /api/streamable/{service} endpoints for bidirectional communication
• Dynamic Nginx configuration for proxy routing
• Service credential pass-through via HTTP headers and direct parameters

🛡️ Enterprise Security

• JWT signature verification with JWKS endpoint validation
• Session invalidation tracking prevents token reuse after logout
• Strong SECRET_KEY validation with cryptographic requirements

Technical Implementation

• Secure session fingerprinting using unique session IDs prevents logout conflicts
• Middleware-based authentication with request-level user context
• OAuth state management with CSRF protection and cache-busting parameters
• Provider abstraction allowing easy addition of new identity providers

Test Plan

• ✅ OAuth login flow with Cognito integration
• ✅ Scope-based authorization enforcement
• ✅ Session management and logout functionality
• ✅ Multi-transport protocol support (SSE + StreamableHTTP)
• ✅ Server toggle permissions and tool execution
• ✅ JWT validation and signature verification