fix(auth): issue durable local MCP sessions

[Artexis10]

Summary

• replace GitHub-backed reference JWTs with durable Exomem-owned opaque sessions
• use GitHub once for login plus immutable user-ID proof, then discard the upstream token
• make HA session validation remote-authoritative with explicit revocation and 503 outage semantics
• add operator commands, setup/doctor validation, coordinated rollout docs, and a Codex reuse harness

Root cause

GitHub retains at most ten OAuth tokens per user/application/scope combination. Production had accumulated 44 upstream-token records, so each new authorization could revoke another active MCP client's token and create the reauthentication loop.

Verification

• focused auth/HA/setup gate: 201 passed, 1 skipped (NTFS does not expose POSIX chmod bits under WSL)
• Ruff: clean
• strict OpenSpec validation: clean
• live hosted-client smoke and coordinated two-replica rollout remain the deployment gate