feat: add authenticated remote MCP access and complete business workflows

apps/api/.env.example

@@ -3,3 +3,9 @@ PORT=3100
 # Local tunnel testing may use WEB_ORIGIN=*. Production requires an exact origin.
 WEB_ORIGIN=http://localhost:5173
 COOKIE_SECURE=false
+# Canonical OAuth protected resource. Production must use HTTPS.
+MCP_PUBLIC_URL=http://localhost:3100/mcp
+# Web confirmation page, normally the same origin as WEB_ORIGIN.
+MCP_WEB_URL=http://localhost:5173
+# Exact browser Origin allowlist; never use *. Non-browser clients may omit Origin.
+MCP_ALLOWED_ORIGINS=http://localhost:5173