Sanitize OAuth telemetry and harden callback HTTP responses

[dcramer]

Problem

SDK OAuth errors may include raw provider response bodies, and non-auth MCP HTTP errors include response text in StreamableHTTPError. Junior captures these exceptions and may attach their messages to logs or spans.

OAuth callback HTML also lacks explicit Cache-Control: no-store, a restrictive referrer policy, and CSP.

Acceptance criteria

• OAuth/MCP transport errors are translated into phase-specific safe error types before logging.
• Raw response bodies, authorization URLs, codes, tokens, client secrets, and provider-controlled HTML/text never enter telemetry.
• Diagnostic metadata records safe phase, provider, status, resource host, and correlation IDs.
• Error response reads are size-bounded.
• OAuth callback responses use Cache-Control: no-store, restrictive referrer policy, CSP, and content-type protections.
• Tests inject secret-bearing/malicious provider errors and assert logs, spans, and HTML remain safe.

Confirmed by the provider-agnostic OAuth implementation audit tracked in #843.

[dcramer]

#847 implements the callback HTTP-response portion of this issue for both generic and MCP success/error pages: Cache-Control: no-store, Referrer-Policy: no-referrer, restrictive CSP, and X-Content-Type-Options: nosniff.

The issue remains open for production OAuth/MCP error translation, bounded provider-body reads, and telemetry secret-safety coverage.

[dcramer]

Correction to the prior update: #847 no longer contains any production callback or oauth-html changes. That commit was reverted so the PR remains test-only and headless. All work in this issue remains open for a separate production PR.