Let agents drive the flow API over MCP

The engine now speaks MCP at /mcp, with a built-in OAuth 2.1 authorization
server in front of it: an agent registers itself, sends a human to the browser
to approve it, and exchanges the resulting code for a token. PKCE is required,
codes are single-use and stored only as hashes, the browser is redirected to
the URI that was registered rather than the one asked for, and refresh tokens
rotate so that replaying a spent one revokes the whole line.

Twenty tools cover reading, building, publishing and running flows, and each
one calls the same REST endpoint the dashboard calls, in-process, carrying the
caller's own token. That keeps one description of what a flow is and what may
be done to it — validation, the draft/publish split, the version check — and
means an agent can do nothing a person could not do in the browser.

Agent tokens are RS256 with a keypair of their own rather than the secret that
signs browser sessions, so deleting the key withdraws every agent without
logging anyone out, and deps.decode_token grew the branch that trusting a
second issuer will need when the hosted login arrives.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

NOTEPAD.md

@@ -27,6 +27,12 @@ Deferring because out of scope is fine, but don't mention deferring than.
 - FEAT/UI: publishing and discarding are only reachable while no side panel is open, since the
   floating chrome hides for the panel. Editing a node's code and publishing it is therefore
   close-panel-then-publish.
+- FEAT/UI: no screen for the OAuth clients an agent registers. They can only be listed or
+  removed in the database, so withdrawing one agent's access means deleting its rows or
+  rotating `OAUTH_PRIVATE_KEY_FILE`, which cuts off all of them.
+- CHORE/INFRA: `requires-python` is capped below 3.14 because the MCP SDK wants a newer
+  starlette there than the pinned `sentry-sdk<2` allows. Lift the cap when sentry-sdk moves
+  to 2.x.
 - FEAT/UI: there is no screen for managing the secrets store itself. A node parameter marked
   `x-secret` offers the stored secrets, but they can only be created through the API.
 - FEAT/FLOW: input discretization drops the trailing edge — if a producer goes quiet inside