Add wger_oidc auth

[rolandgeider]

wger 2.7 ships allauth.idp.oidc: wger is an OAuth2/OIDC provider and its REST API accepts the access tokens it issues. That removes the premise ADR 0001's token exchange was built on — the API used to accept only wger-native credentials, so an IdP token had to be traded for one.

The new strategy makes this server a plain resource server: the caller's wger token goes back out on the /api/v2/ call unchanged. WGER_BASE_URL is the whole configuration — no identity provider, no client credentials, no audience, no provider slug. And because the login runs in the user's browser on wger's own login page, MFA enrolled in wger works, which the headless exchange could never support (HANDOFF #4).

The tokens are opaque, so nothing is validated here: wger is the only authority on whether one is live and which scopes it carries, and it checks on every call anyway. Two things follow, both handled:

• A dead token surfaces at the first API call. api_err now attaches a hint to a 401 saying the connection has to be authorized again, and to a 403 naming the scope the grant is missing — an agent that saw only the status code retried until it gave up.
• The caller has no name in the token. It is fetched from /api/v2/userprofile/ only when MCP_OIDC_ALLOWED_USERS makes it necessary, once per token, keyed by a SHA-256 fingerprint.

The AS facade now serves both OAuth modes and, under wger_oidc, adds the api:read/api:write scopes to the /authorize query and to a proxied dynamic client registration. A generic MCP client asks for openid alone, wger refuses the later /authorize with invalid_scope, and the connector is dead with nothing saying why. /register is advertised and proxied exactly when wger has DCR on — allauth publishes registration_endpoint in its discovery document then and only then, so there is nothing to configure here.

MCP_AUTH keeps defaulting to oidc. An existing deployment has OIDC_* set and may leave MCP_AUTH unset; flipping the default would silently turn it into a pass-through server whose tokens wger rejects.

New settings: MCP_WGER_SCOPES, MCP_AS_FACADE, OAUTH_REGISTER_PATH. See docs/adr/0005-native-wger-oidc.md.