[FRFlo]

Summary

• Add OAuth challenge handling for remote Executor MCP via the SDK OAuth provider, browser authorization, and a temporary loopback callback.
• Persist OAuth registration and tokens per server origin under the user home directory with restrictive file permissions where supported.
• Reuse saved tokens for headless calls and report interactive-auth needs without launching a browser.
• Add provider, callback, and end-to-end OAuth/MCP tests; document storage behavior.

Verification

• Focused OAuth/MCP tests: 17 passed.
• Typecheck and lint pass.
• Full suite has three existing Windows path/sidecar failures, reproduced on the unmodified base branch.