refactor(auth): simplify MCP consent screen

[irvinebroque]

Summary

• retain the per-client MCP consent interstitial required before forwarding to Cloudflare OAuth
• reduce the visible page to the requesting client name, full registered redirect URI, complete third-party API scope set, and explicit Cancel/Continue controls
• continue requesting every configured Cloudflare scope so the upstream Cloudflare consent page can handle optional permission selection
• preserve signed remembered-client consent, CSRF validation, restrictive CSP/clickjacking protection, and OAuth state/session binding
• return OAuth access_denied to the validated client redirect when the user cancels

Verification

• pnpm --filter @repo/mcp-common test (157 tests)
• pnpm --filter @repo/mcp-common check:types
• pnpm --filter @repo/mcp-common check:lint
• targeted Prettier check for changed files
• git diff --check

Notes

• repository-wide pnpm check:format remains blocked by the pre-existing untracked .opencode/package.json; the changed files pass Prettier.

[irvinebroque]

WIP — think you are right that spec requires some kind of interstitial