Map hosted OAuth consent to command permission classes #1907

Part of #1357. Plan: cli-first-mcp task 6.6 (design, tasks). Depends on #1880, #1899.

Keep #1670's API Read and API Write grants: Read allows read commands (and the read execute tool), Write allows write and destructive commands. The existing skill checkboxes map to command groups until consent is simplified.

Related: #941, #816.

Done when

• A test per grant.

via @BYK.

--

View Session in Sentry