feat(mark3labs): add adapter for mark3labs/mcp-go [AP-14]

[RobertoIskandarani]

Summary

• New module github.com/authplane/go-sdk/mark3labs — Authplane adapter for mark3labs/mcp-go, parallel to the existing official-SDK adapter at go-sdk/mcp/. Mirrors the Python authplane-fastmcp package referenced as the example in the ticket.
• Surface: Adapter, NewAdapter, AuthMiddleware, HTTPContextFunc (bridges claims into the mark3labs per-tool-call context via server.WithHTTPContextFunc(...)), ProtectedResourceMetadataHandler, ClaimsFromContext/TokenFromContext, TokenExchange, ConsentElicitationError, typed URLElicitationError.
• Closes AP-14.

Note: opened against AuthPlane/go-sdk because AuthPlaneLabs/go-sdk currently has forking disabled and grants the author READ-only — once write access or forking is enabled there, this can move over.

Design notes

• Bearer parsing & WWW-Authenticate done directly in AuthMiddleware — no auth.RequireBearerToken shim needed, since mark3labs/mcp-go doesn't use it. Header is RFC 6750 §3.1 quoted from the start (no quoter post-processor), and error_description is sanitised so verifier messages can't inject extra header lines.
• Context bridge: adapter.HTTPContextFunc() is paired with server.WithHTTPContextFunc(...) to forward claims/token from the HTTP request context into the per-tool-call MCP context (without this option mark3labs/mcp-go gives tool handlers a fresh ctx).
• URL elicitation caveat: mark3labs/mcp-go coerces every error returned from a tool handler to JSON-RPC -32603 (INTERNAL_ERROR); custom codes like -32042 don't propagate. Documented prominently in docs/user-guide.md §7.2 and demo/README.md, alongside the recommended IsError: true CallToolResult workaround — same trade-off the Python FastMCP adapter calls out.
• PRM: we mount our own ProtectedResourceMetadataHandler instead of mark3labs' built-in server.WithProtectedResourceMetadata(...) so the PRM JSON stays byte-identical across Authplane adapters.

Module / workspace changes

• New module go-sdk/mark3labs/ registered in go.work.
• go.work Go floor bumped 1.25.0 → 1.25.5 (mark3labs/mcp-go v0.54.0 requires >= 1.25.5). Sibling modules (core, http, mcp) continue to build and pass tests.

Test plan

• cd mark3labs && go build ./... — clean
• cd mark3labs && go vet ./... — clean
• cd mark3labs && go test ./... — 27 tests passing (bearer parsing, claims injection, ES256, expired/missing tokens, PRM, introspection regression, HTTPContextFunc bridge, consent→elicitation mapping, MarshalData payload shape)
• Sibling modules unaffected: core, http, mcp all green after the go.work bump
• Manual run of demo/ against the local authserver (reviewer)

🤖 Generated with Claude Code