#7353 feat(credential-groups): add personal MCP OAuth connections

Summary

• let Credential Groups offer OAuth MCP servers to invited people
• keep each invitee MCP grant separate and enforce group workflow policies during execution
• revoke managed connections and release MCP assignments when servers, people, or groups are removed
• replace the API-key enrollment implementation

Type of Change

• Feature

Testing

• bun run lint
• bun run check:audits
• bun run check:migrations origin/staging
• 175 focused Credential Group and MCP tests
• tested a generic OAuth MCP connection locally

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)