remote-mcp-bridge: OAuth-gated MCP endpoint at /mcp