MCP front-door spike (P2b — WP-delegation /authorize + /callback). Provider serves: /token, /register, /.well-known/oauth-authorization-server, /.well-known/oauth-protected-resource. API (auth required): /c/:siteId/mcp and /mcp?site=:siteId.