Bound implicit OAuth initialization waits

[chubes4]

Summary

• Bound implicit OAuth callback waits to the configured OAuth operation timeout instead of the five-minute coordination lock lifetime.
• Bound secondary-process lock polling to the same operation budget without extending the deadline by a final one-second poll.
• Add OAUTH_TIMEOUT_MS configuration for deterministic runtime and regression coverage.
• Verify that headless MCP initialization returns the structured degraded response when no OAuth callback arrives, while successful callbacks still complete normally.

Closes #103.

Verification

• npm run check
• npm run build
• npm test -- --runInBand (229 tests passed)
• npx jest tests/unit/implicit-oauth-timeouts.test.ts tests/integration/dead-backend.test.ts --runInBand --detectOpenHandles

AI Assistance

OpenAI GPT-5.6 Terra through OpenCode drafted the implementation and regression tests. OpenAI GPT-5.6 Sol through OpenCode reviewed the change, corrected child-process teardown, and ran verification. Chris Huber reviewed and owns the submitted change.