OAuth tokens accepted at the actions endpoint

The MCP server's OAuth tokens are now a credential of POST /api/v1/actions/{id}, with the same per-action scopes as API keys. Consent is granted per action, on niiko's consent screen.