epic: hosted remote MCP (HTTP + OAuth)

[jaballer]

Context

North-star zero-install path. Server is stdio-only today (StdioServerTransport, index.js L69).

Proposal

Scope a hosted Streamable-HTTP endpoint + OAuth; multi-tenant token handling; security review. Design doc + spike first.

Acceptance criteria

• Design doc + feasibility spike
• Product + security sign-off before build

Large; needs product + security partnership. Source: onboarding analysis.