Add MCP OAuth device flow for protected namespaces

[Copilot]

MCP server couldn't access protected namespaces: no TTY for browser OAuth, MCP clients timeout at ~60s, and token iterator doesn't discover tokens saved to OSDF config.

OAuth2 Device Flow (oauth2/oauth2.go)

• InitiateDeviceAuth() — returns verification URL without blocking
• PollDeviceAuth() — polls with context cancellation support
• DeviceAuthInfo struct holds flow state between calls

Client Wrappers (client/acquire_token.go)

• InitiateDeviceAuth() — federation discovery + client registration
• CompleteDeviceAuth() — returns (token, namespace, error) for cache keying

MCP Server State (mcp/server.go)

• pendingAuths map for in-flight auth state
• cachedTokens map keyed by namespace prefix
• getTokenForURL() matches URLs to cached tokens via path prefix
• Sets PELICAN_SKIP_TERMINAL_CHECK=true on init

MCP Tools (mcp/tools.go)

• pelican_auth — initiates device flow, returns verification URL immediately
• pelican_auth_complete — polls (45s timeout), caches token by namespace
• handleDownload/Stat/List — auto-inject cached tokens
• pelican_download — updated description to require user-provided destination

Example Flow

User: List pelican://osg-htc.org/osdf-tutorial/protected

AI: [pelican_auth]
🔐 Visit: https://cilogon.org/device?user_code=ABCD-1234

User: Done.

AI: [pelican_auth_complete]
✅ Token cached for /osdf-tutorial/protected

AI: [pelican_list] → uses cached token → success

Note: The verification link validity (typically 15 min) is server-driven via the OAuth expires_in response field, not hardcoded.

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.