Roadmap P1: remote MCP (streamable HTTP + OAuth) and tool-level scoping

Phase 1 of the [AI-era roadmap](https://github.com/solomon2773/openhosting/blob/main/docs/roadmap.md).

Upgrade the bundled MCP server: streamable-HTTP transport secured by the built-in OAuth provider (no local install for hosted AI clients), per-key tool-level scoping in the admin UI, and MCP Registry listing.