Add scoped MCP, OAuth, tokens, and bounded traces

[navanchauhan]

What changed?

• Added authenticated Streamable HTTP MCP with scoped read and write tools.
• Added OAuth 2.1 with PKCE S256, dynamic client registration, and generic browser OIDC.
• Added personal API tokens with scopes, expiry, one-time display, and revocation.
• Added scope-based write protection and stricter proxy-header handling.
• Added responsive mobile views, touch-safe theme selection, and mobile token management.
• Added OpenAPI JSON/YAML, llms.txt, MCP guidance, and client authentication guidance.
• Added batch blob reads, batch append, parallel projection, ancestry checkpoints, bounded trace pages, and exact turn hydration.
• Corrected separate tool-result hydration and named-key MessagePack projection. Numeric tags have priority.
• Pinned compatible container toolchains and updated the public Go lint action so CI can analyze the Go 1.25 gateway.

Why?

These changes make CXDB usable by MCP and API clients, add browser-managed credentials, improve mobile operation, and reduce large-trace response cost without introducing private systems.

For a representative 100-turn page from a 400-turn trace with 16 KiB messages, the bounded response changed from 1,659,078 bytes at a 5.38 ms median to 71,497 bytes at a 1.92 ms median. Each median used 10 warm samples.

How to test?

cargo fmt --all -- --check
cargo clippy --workspace --all-targets --all-features -- -D warnings
cargo test --workspace

cd clients/go && golangci-lint run --timeout=5m && go test ./... && go vet ./... && go build ./...
cd gateway && golangci-lint run --timeout=5m && go test ./... && go vet ./... && go build ./...

cd frontend && pnpm lint && pnpm exec tsc --noEmit && pnpm build
CXDB_TEST_FRONTEND_PORT=3003 pnpm test

docker build --platform linux/amd64 -t cxdb-check .
docker build --platform linux/amd64 -f gateway/Dockerfile -t cxdb-gateway-check .

Playwright result: 75 passed and 2 intentional offline tests skipped.

Checklist

• Tests pass locally (cargo test, go test ./..., pnpm test)
• Linters pass (cargo clippy, cargo fmt, golangci-lint run, pnpm lint)
• Documentation updated (if applicable)
• CHANGELOG.md updated (if user-facing change)
• Breaking changes documented (if applicable)
• No compiled binaries committed
• No secrets or credentials committed

Related Issues

None.