feat: add FastMCP OAuthProxy support for remote MCP server

[DrFaust92]

Summary

Adds support for running okta-mcp-server as a remote HTTP server using FastMCP's OAuthProxy, enabling browser-based Okta SSO authentication. This allows deployment as a shared service (e.g. Docker/Kubernetes) where users authenticate via browser redirect instead of the device auth flow.

• Dual transport modes: stdio (existing CLI behavior) and streamable-http (new remote mode), controlled via MCP_TRANSPORT env var
• OAuthProxy integration: Proxies OAuth authorization code flow through Okta's /oauth2/v1/authorize and /oauth2/v1/token endpoints
• Token introspection: Custom OktaIntrospectionVerifier validates opaque Okta access tokens via the /oauth2/v1/introspect endpoint
• Dual-mode client auth: In stdio mode, uses keyring; in HTTP mode, extracts the Bearer token from MCP auth context and passes it to the Okta SDK
• Docker-ready: Dockerfile defaults to streamable-http transport with port 8000 exposed

Files changed

File	Change
server.py	OAuthProxy setup, OktaIntrospectionVerifier, transport-aware lifespan
client.py	Dual-mode get_okta_client() — keyring vs Bearer token
pyproject.toml	Switch mcp[cli] → fastmcp>=3.0.0, add httpx
Dockerfile	Default MCP_TRANSPORT=streamable-http, EXPOSE 8000
.env.example	New env vars: MCP_TRANSPORT, MCP_SERVER_URL, OKTA_CLIENT_SECRET

Test plan

• Verify existing stdio mode still works unchanged
• Test MCP_TRANSPORT=streamable-http with Okta OAuth app configured
• Validate token introspection against Okta /oauth2/v1/introspect
• Test Docker build and run with streamable-http transport
• Confirm browser redirect flow completes successfully

Closes #13

🤖 Generated with Claude Code