MCP OAuth: optional oauth.issuer to pin configured client credentials before first use #171

Follow-up from #169 (GHSA-6qxp-vccf-f47h, #50).

Problem

#169 binds MCP OAuth clients configured with oauth.clientId / oauth.clientSecret to an authorization server on their first successful use (trust on first use). Until that first use, the configured credentials carry no issuer. On a fresh install, after aictrl mcp logout, or after oauth.clientId changes, SDK 1.32.1 therefore presents the configured client_secret to whichever authorization server the MCP server advertises in its protected-resource metadata. If the first server reached is malicious, it can harvest a long-lived static secret.

Proposal

Add an optional oauth.issuer to the MCP OAuth config (McpOAuth in packages/cli/src/config/config.ts). When it is set, McpOAuthProvider.configuredClientInformation() returns it as the issuer stamp straight away, so the SDK never presents the configured secret to any other authorization server, including on first use. When it is not set, keep the current trust-on-first-use behaviour.

Acceptance criteria

• oauth.issuer is accepted by the config schema and documented next to clientId / clientSecret.
• With oauth.issuer set, a test using the real SDK auth() (see test/mcp/oauth-issuer-binding.test.ts) shows that a first-ever authorization against a different advertised authorization server sends no configured secret.
• When oauth.issuer conflicts with a stored binding, the configured value wins.