Fix MCP instance OAuth redirects

[hbanerjee74]

Summary

• preserve MCP catalog header contracts in typed conversions and catalog sync tests
• add the MCP server instance OAuth URL route used by Studio to start downstream OAuth
• allow the matching MCP instance OAuth redirect route through authz for owned instances

Why

Studio's real-Obot MCP setup flow creates per-user MCP server instances and then drives downstream OAuth through Obot. The route exists and the browser journey reaches it, but the OAuth redirect request is denied unless the authz resource map recognizes /api/mcp-server-instances/{id}/oauth-redirect as an owned MCP server instance action.

Validation

• go test ./pkg/api/authz -count=1
• Studio focused integration with locally built Obot image: OBOT_IMAGE=obot-vibedata:local-test npx playwright test --config config/playwright/playwright.backed.config.ts tests/e2e/journeys/backed/mcp-real-obot-backed.journey.spec.ts -g 'drives setup, OAuth, unsupported, and disconnect paths against real Obot'

Release note

After this merges, the Build and Push obot-vibedata workflow should publish a new ghcr.io/accelerate-data/obot-vibedata:latest digest. Studio then needs to run npm run obot:image:bump and rerun the Obot-focused gates against the new pinned digest.