[P0] Establish Better Auth MCP OAuth authority on auth.replynodes.com

[replynodes-ai]

Parent epic: #21

Goal

Make Better Auth the single OAuth authorization authority for ReplyNodes MCP.

Scope

• Host the stable OAuth issuer on https://auth.replynodes.com.
• Configure Better Auth with existing Google/GitHub social login.
• Add jwt(), @better-auth/mcp, and @better-auth/cimd.
• Configure canonical MCP resource as https://mcp.replynodes.com/mcp.
• Use mcp:read as the MCP authorization scope.
• Support OAuth 2.1 Authorization Code + PKCE.
• Enable CIMD as the primary client metadata mechanism.
• Enable DCR only as compatibility fallback for clients that still require it.
• Provide login and consent pages suitable for Claude/Hermes/Cursor browser authorization.
• Ensure OAuth access tokens are resource-bound to the canonical MCP resource.
• Expose JWKS/metadata required for resource-server validation.
• Do not register a second/parallel OAuth provider implementation.

Remove / avoid

• No custom OAuth server.
• No client-specific Claude/Hermes OAuth branches.
• No reuse of legacy pos_* application OAuth.
• No custom PKCE/DCR implementation where Better Auth already owns it.

Acceptance criteria

• A standards-compliant MCP client can discover the ReplyNodes authorization server starting from the MCP protected resource.
• A logged-out user can authenticate with Google or GitHub, approve mcp:read, and return an authorization code via PKCE.
• The token endpoint issues an access token valid only for https://mcp.replynodes.com/mcp.
• JWKS/issuer metadata is usable by the MCP resource server.
• Refresh behavior works through Better Auth where supported.

Tests — only necessary

Add a small integration check for metadata/discovery + one PKCE authorization/token happy path. Do not unit-test Better Auth internals or social-provider SDK behavior.