fix: remove non-functional OAuth2.1/DCR flow, keep client-credentials and bearer token auth

[ThisIsDemetrio]

… and bearer token auth

What this PR is for?

After the release of the Mia-Platform Console v15, the OAuth flow cannot be managed by the MCP Server itself, since it won't be able to hit correctly the new authentication layer.

This PR is a proposal to remove the OAuth routes. It is in draft because we want to better analyze the possibilty of connectin with the Keycloak instance of Mia-Platform Console and/or evaluate alternatives.

• The local /authorize and /token handlers in oauthRouter.ts proxied requests to /api/authorize and /api/oauth/token on CONSOLE_HOST. Those endpoints no longer exist in the current Console architecture: OAuth/OIDC is now handled by authtool's BFF + Keycloak, and its only route that returns a raw access token (/bff/token) is not publicly exposed by the API Gateway — it's reachable exclusively from Envoy's internal Lua token-exchange filter. There is no supported way for an external service like this one to complete that flow, and no change on this repo's side can fix it.
• Removed src/server/auth/{oauthRouter,wellKnownRouter,clientCredentialsManager,types}.ts and their tests, along with the now-unused getBaseUrlFromRequest helper (src/server/utils.ts) and the @fastify/formbody dependency (only needed for the removed form-encoded /token//register endpoints).
• /mcp's existing behavior is preserved as the two remaining, functional auth paths:
  • Service Account (client credentials) via MIA_PLATFORM_CLIENT_ID/MIA_PLATFORM_CLIENT_SECRET — unaffected by this change.
  • Bring-your-own bearer token — when no service account is configured, /mcp requires an Authorization header and forwards it as-is to the Console APIs, which validate it. This already existed but wasn't documented; the README/default.env now describe it explicitly instead of the dead OAuth2.1/DCR flow.
• Simplified the 401 response on missing token to a plain WWW-Authenticate: Bearer header, dropping the resource_metadata pointer to the removed .well-known/oauth-protected-resource endpoint.