Add persistent OAuth authentication to Score Studio CLI

[SpaYco]

Summary

• expose the CLI as score-studio with npm run auth, auth login, and auth logout flows
• offer keyboard-selectable OAuth or API-key authentication and persist credentials securely
• keep the stdio MCP server running after first-time authentication
• add a hosted Streamable HTTP MCP server with OAuth discovery, token exchange, caching, and safe errors
• separate the private API transport URL (SCORESTUDIO_URL) from the public OAuth API audience (SCORESTUDIO_API_RESOURCE)
• authenticate token exchange with the dedicated SCORESTUDIO_MCP_EXCHANGE_SECRET
• document production and local Claude connector requirements and acceptance tests
• redirect browser login completion to the branded Score Studio page

Deployment requirements

Set PLATFORM_OAUTH_EXCHANGE_SECRET on Score Studio API and set the exact same dedicated value as SCORESTUDIO_MCP_EXCHANGE_SECRET on the MCP gateway. Do not reuse PLATFORM_INTERNAL_API_TOKEN; production startup now rejects that configuration.

The gateway may call a private address such as http://platform:8000 while OAuth tokens target https://api.scorestudio.ai. SCORESTUDIO_API_RESOURCE keeps token exchange bound to the public audience without forcing internal traffic through public ingress.

Validation

• npm run check
• 12 tests passed
• all 7 manifests and 6 required package files validated
• live ngrok test completed OAuth and authenticated MCP initialize