feat(mcp): bind validated OAuth subscriptions

[akadlec]

Summary

• carry the stable access-token management ID, exact authorization deadline, effective OAuth scopes, and module/client/grant generations through validated OAuth principals
• fail closed when persistent module-policy generation state is unavailable
• bind OAuth listen subscriptions to validated internal client and artifact identities
• record effective scopes and authorization generations on subscription records while preserving static subscription behavior
• update the Phase 5 implementation plan to mark validated subscription binding complete

Why

The targeted invalidation registry added in Phase 5b was not yet connected to validated OAuth requests. Phase 5c establishes that runtime identity boundary so future revocation and scope-contraction mutations can target streams using non-secret management identities and generation snapshots.

Impact

No public OAuth routes or user-facing enable switch are exposed. Static MCP subscription registration remains unchanged. The authoritative subscription registration/invalidation generation gate remains intentionally deferred to the next Phase 5 slice.

Validation

• backend TypeScript type-check
• targeted backend lint
• Prettier verification
• 38 focused tests
• 2 snapshots
• git diff --check