feat(python): MCP server OAuth form quick wins (read-only redirect URI, drop password grant)

[msureshkumar88]

Pull Request

Credit: All code in this PR is the work of @marekdano (both commits, both Signed-off-by) and @Altamimi-Dev, who opened and drove the original PR #5786 through review. This PR only exists to carry that already-reviewed, already-approved work past a fork-push permission limit — GitHub doesn't allow reassigning PR authorship, so it shows as opened by me. Please attribute the work to them.

🔗 Related Issue

Relates to #5721 (delivers the backend pieces of User Stories 1, 2, and 4; Story 3 — pre-fill from MCP initialize — is deferred, see #5719).

Supersedes #5786 — same commits, rebased onto current main. That PR's head branch lives on a fork we don't have push access to, so a fresh PR against a branch on this repo was needed to land the already-reviewed and approved rebase.

---

📝 Summary

Backend half of the MCP server OAuth form quick wins: closes an OAuth 2.1 foot-gun (deprecated password grant) and hardens redirect_uri handling for the authorization-code flow. The React UI half now lives in contextforge-org/contextforge-web-ui#15.

• Deprecated password grant rejected (Story 4): GatewayCreate rejects grant_type == "password" at the schema layer, so new MCP server registrations can't use it regardless of how they're created (UI or API). Existing gateways that already use it keep working through GatewayUpdate — but GatewayUpdate now also rejects newly adopting password on a gateway that wasn't already using it, so the create-time restriction can't be bypassed via the update path. The legacy admin UI's gateway creation form no longer offers the option either (the edit form still does, for loading/saving existing legacy configs).
• redirect_uri defaulting (Story 1, server-side): initiate_oauth_flow and oauth_callback default a missing redirect_uri to the gateway's own global callback ({app_domain}{app_root_path}/oauth/callback), so API-created and legacy configs can't reach OAuthManager's PKCE paths without one. The default accounts for a reverse-proxy app_root_path, logs when it's actually applied, and the substitution logic is centralized in OAuthManager.
• redirect_uri pinned across the flow: the value sent to the IdP at authorize time is now pinned into server-side OAuth state (alongside the PKCE code_verifier) and reused at token-exchange time, so a concurrent gateway config change or app_domain change between authorize and callback can't cause the two to diverge (RFC 6749 §4.1.3). Adds a redirect_uri column to oauth_states (migration included).
• Resource (RFC 8707) — Story 2: already satisfied server-side; no change needed beyond confirming the behavior.

All review feedback from #5786 (password-grant update loophole, app_root_path handling, missing logging, redirect_uri pinning, legacy UI option) is already addressed in these commits, and the PR was approved there before the rebase.

---

📏 Reviewability

• This PR has one clear purpose
• The linked issue is not labeled triage
• Unrelated bugs or improvements are tracked in separate issues/PRs
• Tests are included with the code they validate

---

🏷️ Type of Change

• Feature / Enhancement

---

🧪 Verification

Check	Command	Status
Schema/gateway tests	pytest tests/unit/mcpgateway/test_schemas_validators_extra.py tests/unit/mcpgateway/services/test_gateway_service.py -k "oauth or gateway_create or gateway_update or password"	✅
OAuth router tests	pytest tests/unit/mcpgateway/routers/test_oauth_router.py	✅
OAuth manager tests	pytest tests/unit/mcpgateway/services/test_oauth_manager.py	✅
Alembic heads	alembic heads	✅ single head

---

✅ Checklist

• Code formatted
• Tests added/updated for changes
• Documentation updated (if applicable)
• No secrets or credentials committed

[Lang-Akshay]

LGTM