RFC for Embedded Auth Server in vMCP

[tgrunnagle]

Related issue: https://github.com/stacklok/stacklok-epics/issues/251

Adds a new RFC proposing an optional embedded OAuth 2.0/OIDC authorization server inside the Virtual MCP Server (vMCP).

Why

vMCP today requires clients to arrive with a pre-obtained upstream IDP token. There is no mechanism for vMCP to orchestrate the auth flow itself — redirect clients through IDPs, collect their tokens, and issue a session-scoped ToolHive JWT. This RFC closes that gap.

Key Design Decisions

• Two-mode operation: vMCP works identically to today when AuthServer is unset (Mode A). When set (Mode B), the embedded AS becomes the OIDC issuer; existing external-OIDC deployments are unaffected.
• Self-referencing OIDC discovery: OAuth/OIDC endpoints (/.well-known/openid-configuration, /oauth/…) mount at the same origin as the vMCP HTTP server so the OIDC middleware's discovery call loops back to the embedded AS.
• identity.UpstreamTokens plumbing: After TH-JWT validation the OIDC middleware eagerly loads accumulated upstream tokens into identity.UpstreamTokens. Downstream outgoing auth strategies (deferred to follow-up RFC) consume from there.
• CRD change: VirtualMCPServerSpec gains AuthServerConfig *ExternalAuthConfigRef; the referenced MCPExternalAuthConfig must be of type embeddedAuthServer. ExternalAuthConfigRef is moved from mcpserver_types.go to mcpexternalauthconfig_types.go.
• allowedAudiences by construction: Not a CRD field — the operator converter derives it from IncomingAuth.OIDCConfig.Inline.Audience, preventing audience-mismatch misconfiguration.
• Front-door provider ordering: sub and claims in the TH-JWT are sourced from the first upstream IDP in upstreamProviders. Operators should list the corporate IDP first when present.
• Outgoing token injection deferred: The upstream_inject outgoing auth strategy is explicitly out of scope; it will be specified in a follow-up RFC once the identity.UpstreamTokens plumbing (this RFC) and multi-IDP support (RFC-0052) are in place.

Depends On

• RFC-0052 — Multi-Upstream IDP Support in the Embedded Auth Server (provides identity.UpstreamTokens population in the OIDC middleware)

[jhrozek]

Looks good!

[jerm-dro]

My biggest concern is the incremental accumulation of more complexity in server.go that I'd like to find a way to better manage.

Otherwise this LGTM