#33 feat(auth): support Pip application access

Why now

Production already runs this change, but main doesn't have it. On 2026-09-12 the ooxml-mcp Worker was deployed by hand from this branch (version 2bebfc04, with the PIP_API_KEY_SHA256 secret set), and migration 0008_mcp_app_usage.sql was applied to the production database.

Because of that, the Deploy run for #31 failed at migrate-db with Database migration 0008_mcp_app_usage.sql does not exist in this checkout, so the sign-in loop fix never shipped. Merging this brings main back in line with production and lets that deploy run.

What it does

• Adds a revocable Pip application key for the existing read-only MCP tools (apps/mcp-server/src/app-auth.ts). Requests carrying an ooxml_app_ bearer token are checked against the PIP_API_KEY_SHA256 hash. Human OAuth is unchanged.
• Records application usage with app_id in mcp_usage_events (migration 0008).
• The CLI uses OOXML_API_KEY when it's set and skips browser login.
• Adds docs/pip-app-access.md with activation and revocation steps.

Verification

• Rebased the original commit onto current main (which includes #31), with no conflicts.
• bun run mcp:test (47 pass), bun run cli:test (14 pass), typecheck, and format check on changed files all pass.
• Migration 0008's checksum matches the row in production schema_migrations (6c335862…), so migrate-db will treat it as already applied.
• The production Worker already has PIP_API_KEY_SHA256 set.

🤖 Generated with Claude Code