fix: Complete ADR 006 implementation - fix all remaining test failures

.env.example

@@ -51,11 +51,6 @@ HTTP_HOST=localhost
 # OAUTH_SCOPES=openid,profile,email
 
 # ===== Security Configuration =====
-# Token Encryption Key (REQUIRED - Phase 1 Security)
-# AES-256-GCM encryption for all token storage (32-byte base64-encoded key)
-# Generate with: node -e "console.log(require('crypto').randomBytes(32).toString('base64'))"
-# TOKEN_ENCRYPTION_KEY=your_256bit_encryption_key_here
-
 # Use HTTPS in production
 REQUIRE_HTTPS=false
 
@@ -88,11 +83,14 @@ REQUIRE_HTTPS=false
 # Local: redis://localhost:6379
 # REDIS_URL=redis://localhost:6379
 
-# Redis key prefix for multi-app isolation (default: no prefix)
-# Set this to run multiple MCP apps on the same Redis instance without key conflicts
-# Example: 'mcp-main' creates keys like 'mcp-main:oauth:client:abc123'
+# Redis key prefix for multi-tenancy support (default: 'mcp' per ADR 006)
+# Set this to run multiple MCP servers on the same Redis instance without key conflicts
+# Examples:
+#   'mcp-server-1' creates keys like 'mcp-server-1:oauth:client:abc123'
+#   'mcp-dev' for development environment
+#   'mcp-prod' for production environment
 # Note: Colon separator is added automatically if not present
-# REDIS_KEY_PREFIX=mcp-persistence
+# REDIS_KEY_PREFIX=mcp
 
 # ===== LLM Provider Configuration =====
 # At least one provider is required for MCP tool functionality