Implement MCP-spec OAuth for server authentication

Context

The MCP specification defines an OAuth discovery protocol that clients use to authenticate with remote servers. Our current OAuth support is limited to passing a pre-configured Figma OAuth token as a header to the Figma API — it doesn't implement the MCP OAuth protocol where clients authenticate to our server.

This means MCP clients that support OAuth (like opencode mcp auth) correctly report that our server is not OAuth-capable.

What's needed

To be recognized as an OAuth-capable MCP server, we need to:

1. Serve Protected Resource Metadata at /.well-known/oauth-protected-resource — tells clients the server requires auth and points to the authorization server
2. Return 401 with WWW-Authenticate header on unauthenticated requests to /mcp — triggers the client's OAuth flow
3. Serve or point to Authorization Server Metadata at /.well-known/oauth-authorization-server
4. Implement the authorization code flow — redirect users to Figma's OAuth, handle the callback, exchange codes for tokens
5. Validate bearer tokens on incoming MCP requests

References

• MCP Authorization spec
• The MCP TypeScript SDK FAQ says server auth is out of scope for the SDK and recommends integrating with auth packages (e.g. better-auth) or a full authorization server
• The SDK's conformance test server (authTestServer.ts) serves as a reference implementation — it serves /.well-known/oauth-protected-resource, requires Bearer tokens on all MCP endpoints, and validates them via introspection (RFC 7662)