Support separate auth tokens for Onboarding API and MCPs

[andreaskienle]

Implements openmcp-project/backlog#151

Some notes:

• Currently, we assume that the Onboarding API and MCPs can have different client IDs, but all MCPs within a single landscape must share the same client ID. This approach will need to be revised once we support multiple IdPs. I added a comment in the corresponding issue.
• To test this PR, you need to add the env variable OIDC_CLIENT_ID_MCP (see env template)

[Copilot]

Pull Request Overview

This PR implements separate authentication handling for the Onboarding API and MCPs by introducing dedicated auth contexts, routes, and configuration updates. Key changes include:

• Renaming and reworking the authentication context and provider for onboarding.
• Introducing a new MCP auth context and related routes.
• Adjusting session handling, fetch endpoints, and component usage accordingly.

Reviewed Changes

Copilot reviewed 23 out of 23 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
src/spaces/onboarding/auth/AuthContextOnboarding.tsx	Renamed and refactored auth context/provider for onboarding.
src/spaces/mcp/auth/auth.schemas.ts	Added Zod schema for MCP auth response validation.
src/spaces/mcp/auth/AuthContextMcp.tsx	Created new auth context/provider for MCP authentication.
src/main.tsx	Updated to use the new onboarding auth provider and callback handler.
src/lib/shared/McpContext.tsx	Integrated MCP auth when accessing managed control plane routes.
src/lib/api/fetch.ts	Adjusted fetch endpoints to target onboarding routes.
Various component files	Replaced old useAuth usage with useAuthOnboarding.
server/routes/auth-onboarding.js, auth-mcp.js	Updated auth routes to separate onboarding and MCP flows.
server/plugins/session.js, http-proxy.js	Updated session management and token handling for dual flows.
server/config/env.js, .env.template, package.json	Updated configuration and dependencies for the new auth setup.

Comments suppressed due to low confidence (1)

server/plugins/http-proxy.js:89

• Combining onboarding and MCP access tokens as a comma-separated string may lead to unexpected behavior if the downstream service expects a single token. Verify that the downstream API is designed to parse this format or consider handling the tokens separately.

const accessToken = useCrate ? req.session.get("onboarding_accessToken") : `${req.session.get("onboarding_accessToken")},${req.session.get("mcp_accessToken")}`;