Niyra as OAuth authorization server — Phase A

Niyra issues her own access tokens now. Phase B (consent + authorize endpoints) lands next; full third-party MCP client onboarding follows.