Adds Doorkeeper-backed OAuth 2.1 (PKCE, public clients, RFC 7591 DCR)
so Claude connectors can authorize against DocuSeal without a
pre-shared token. The existing McpToken bearer stays as a fallback.
- Mount Doorkeeper at /oauth/* plus root aliases (/authorize, /token,
/register) for clients that strip paths
- Serve RFC 8414 + RFC 9728 discovery at /.well-known/oauth-*
- /register implements RFC 7591 DCR for public clients with an IP
throttle; redirect_uri restricted to https + loopback
- McpController now resolves current_user from a Doorkeeper access
token first, emits the RFC 9728 WWW-Authenticate header on 401
- Weekly sweeper for abandoned DCR applications (external cron)
- Link Connected apps from MCP settings
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Ortes