Add hosted MCP server support with OAuth 2.1 and token refresh

Enables connecting to official MCP servers (like Notion) instead of
building custom WASM tools. Uses OAuth 2.1 with PKCE and supports
Dynamic Client Registration for zero-config authentication.

Key features:
- OAuth 2.1 flow with PKCE for secure browser-based auth
- Dynamic Client Registration (DCR) for servers without pre-configured clients
- Automatic token refresh on 401 responses
- Session management with Mcp-Session-Id headers
- SSE streaming response handling

New CLI commands:
- `mcp add <name> <url>` - Add an MCP server
- `mcp remove <name>` - Remove an MCP server
- `mcp list` - List configured servers
- `mcp auth <name>` - Authenticate with a server
- `mcp test <name>` - Test connection

Also removes the Notion WASM tool example since it's superseded by the
Notion MCP server which provides 13 official tools.

Co-Authored-By: Claude Opus 4.5 <[email protected]>

src/cli/mod.rs

@@ -5,11 +5,14 @@
 //! - Interactive setup wizard (`setup`)
 //! - Managing configuration (`config list`, `config get`, `config set`)
 //! - Managing WASM tools (`tool install`, `tool list`, `tool remove`)
+//! - Managing MCP servers (`mcp add`, `mcp auth`, `mcp list`, `mcp test`)
 
 mod config;
+mod mcp;
 mod tool;
 
 pub use config::{ConfigCommand, run_config_command};
+pub use mcp::{McpCommand, run_mcp_command};
 pub use tool::{ToolCommand, run_tool_command};
 
 use clap::{Parser, Subcommand};
@@ -72,6 +75,10 @@ pub enum Command {
     /// Manage WASM tools
     #[command(subcommand)]
     Tool(ToolCommand),
+
+    /// Manage MCP servers (hosted tool providers)
+    #[command(subcommand)]
+    Mcp(McpCommand),
 }
 
 impl Cli {