feat(ai): redesign settings and add MCP OAuth

[DavidBabinec]

Summary

• redesign the AI workspace around a consistent left-navigation and master-detail layout for Providers, Defaults, and MCP connections
• add provider identity marks, cleaner setup states, shared list patterns, and responsive styling
• implement hosted MCP OAuth with discovery metadata, dynamic public-client registration, S256 PKCE, consent, rotating refresh tokens, replay revocation, and capability-scoped grants
• retain personal access tokens for local and CLI clients, with the same capability gate and revocation model
• update migrations, protocol tests, admin tests, architecture gates, and MCP documentation

Why

The previous settings layout made providers, defaults, and MCP connections feel like separate utilities, while remote MCP setup required users to manually copy long-lived bearer tokens. This gives the entire AI area one coherent information architecture and lets compatible hosted clients connect through a standard OAuth flow.

Screenshots

Providers

MCP connections

Impact

Remote MCP clients can now discover Instatic's authorization server, register as public PKCE clients, request scoped access, and reconnect through rotating refresh tokens. Existing local and custom clients can continue using personal access tokens. The database change is additive in both PostgreSQL and SQLite migrations.

Verification

• focused MCP, OAuth, connector, and admin AI suites: 79 tests passed
• bun run lint
• bunx tsc -b
• bun run build
• bun run icons:check
• bun run bootstrap:check
• migration parity, bundle budgets, and circular-dependency checks
• manual localhost smoke checks for /admin/ai and OAuth metadata

A full repository test run was attempted, but concurrent shared-host stress jobs exhausted the temporary volume. All branch-owned suites and release gates listed above completed successfully.