feat(mcp): OAuth so claude.ai and ChatGPT can connect as connectors

MindSift becomes the OAuth authorization server for its own MCP
endpoint: discovery (RFC 9728/8414), dynamic client registration,
authorization code with PKCE (S256), rotating refresh tokens with reuse
detection. The consent page lives in the app at /oauth/authorize. A
grant is an api_keys entry (kind 'oauth'), so scopes, origin badges,
renaming and revoking work as for keys; tokens are valid for /mcp only.
Unused connections expire after OAUTH_IDLE_DAYS (default 90). Requires
BASE_URL; off in demo mode. Release 0.51.0.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/api/done_cleanup.go

@@ -14,14 +14,16 @@ import (
 
 // startDoneCleanupTicker runs the retention delays (storage/retention.go): completed tasks into the
 // task trash, the trashes and ticked-off list items emptied; once shortly after the start and then
-// every hour.
+// every hour. Expired and unused OAuth connections go in the same pass (oauth.go).
 func (s *Server) startDoneCleanupTicker() {
 	time.Sleep(2 * time.Minute)
 	s.runDoneCleanup(time.Now())
+	s.runOAuthCleanup(time.Now())
 	ticker := time.NewTicker(time.Hour)
 	defer ticker.Stop()
 	for now := range ticker.C {
 		s.runDoneCleanup(now)
+		s.runOAuthCleanup(now)
 	}
 }