gateway source #

based on sigbit/mcp-auth-proxy at 76cf8e089bb0ccad9d8944e0a6c9e8bc2255e8a8, with the colab gateway fixes applied. the upstream mit license is retained in LICENSE.

local changes cover resource/audience binding, owner and oidc identity checks, s256 pkce for all clients, session-bound escaped consent, redirect validation, private request logging, and google colab account linking. the original go module path is retained so internal imports and the existing oauth state stay compatible.