Policy interface for provider-specific MCP OAuth quirks.
Each concrete provider module (e.g. slack, github) subclasses
OAuthProvider to encode its own URL match rule, client metadata, and
any pre-handshake login steps (preseeding client info, running a
device flow, prompting for workspace IDs). mcp_auth dispatches to
the first matching provider via resolve_provider, so adding a new
provider is one new module plus one registry entry — no edits to
build_oauth_provider or login.
