fix(mcp): forward configured OAuth scopes during login

[kriptoburak]

Summary

• Forward configured OAuth scopes through the UI, API, and infrastructure layers.
• Preserve server metadata discovery when no scopes are configured.
• Document remote OAuth login with a working Xquik MCP example.
• Cover configured and discovery-based scope selection with regression tests.

Problem

forge mcp login always passed an empty scope list to the OAuth client. This ignored oauth.scopes from .mcp.json. Scoped servers could then issue insufficient tokens or reject the flow.

The change keeps empty scopes for metadata discovery. It forwards explicit scopes when users configure them. The Xquik example uses its published mcp:tools scope for authenticated X (Twitter) search and automation.

Addresses #3339.

Verification

• cargo test -p forge_domain mcp::tests -- --nocapture
• cargo check -p forge_main
• cargo test -p forge_main --no-run
• cargo clippy -p forge_main --all-targets --all-features -- -D warnings
• rustfmt --edition 2024 --check on all changed Rust files
• README MCP configuration parsed successfully with jq

Co-Authored-By: ForgeCode noreply@forgecode.dev

[CLAassistant]

All committers have signed the CLA.