Talos MCP (read-only): POST /mcp with a Bearer; OAuth at /.well-known/oauth-authorization-server