Release: merge develop into main

[Rabithua]

Summary

• Merge the latest develop updates into main.
• Adds Rote-owned OAuth 2.1 authorization and Remote HTTP MCP support, including OAuth metadata, dynamic client registration, authorization/session/approve, token, revoke, bearer-token MCP access, and MCP tools for notes, articles, reactions, profile, data, settings, and attachments.
• Adds attachment upload presign/finalize server modules and MCP attachment tooling.
• Updates user-facing account verification terminology to certified across API payloads, docs, admin UI, and Postman examples, with temporary compatibility for legacy names.
• Hardens first-run setup by masking generated secrets in setup responses and splitting admin route responsibilities into clearer modules.
• Improves AI provider/tool-calling compatibility for thinking models by using automatic tool choice in probes.
• Refactors frontend login, OAuth authorization, admin AI configuration, and landing page sections into focused components.
• Updates the primary brand color to #3ECF4A across theme tokens, logo assets, export cards, heatmap, and related UI surfaces.
• Includes smaller API/UI fixes: iOS login registration redirect handling, author bio in note responses, and removal of the default local AI context override.

Scope

• 17 commits from origin/develop not in origin/main.
• 141 files changed, 13,341 insertions and 2,359 deletions.
• Key merged PRs: [codex] Fix tool calling probe for thinking models #270, [codex] Mask setup generated secrets #271, [codex] Add OAuth HTTP MCP support #272, [codex] Unify user certification naming #273, [codex] Update primary brand color #275.

Validation

• cd web && bun run lint
• cd web && bun run build
• cd server && bun run lint
• cd server && bun run build

Notes: frontend build succeeds with existing Vite chunk-size / circular chunk warnings.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.