dtfonestop-mcp v1.0.0 — Phase 1 ready (login + OAuth + MCP whoami)

Endpoints:
  GET    /                                       — this page
  GET    /.well-known/oauth-authorization-server ✓
  GET    /.well-known/oauth-protected-resource   ✓
  GET    /login                                  ✓
  POST   /login                                  ✓
  GET    /authorize                              ✓
  POST   /authorize/decide                       ✓
  POST   /token                                  ✓ (authz_code + refresh)
  POST   /register                               ✓ (DCR + CIMD)
  POST   /mcp                                    ✓ (JSON-RPC, OAuth Bearer)
  GET    /mcp                                    ✓ (405 — no server push)
  DELETE /mcp                                    ✓ (terminate session)

See plan/26-mcp集成.md for design + implementation roadmap.