feat(#455 slice 3): reuse the OIDC login for the platform/MCP broker identity (dev-time delegated MCP)

[initializ-mk]

Follow-up to #490. Slice 2 (#490) makes forge auth login a first-class OIDC login yielding a short-lived IdP token cached under ~/.forge. This slice reuses that identity so a developer's local agent brokers managed MCP tokens as themselves, identical to a deployed run — no separate CLI, no hand-pasted tokens.

Parent: #455. Base: #490 (native OIDC GatewayTokenProvider + interactive forge auth login).

Scope (forge side)

1. Platform settings block (parallel to settings.ModelGateway's OIDC fields from feat(#455 slice 2): native OIDC GatewayTokenProvider (auth-code+PKCE / device-code / client_credentials) #490): platform.base_url for the managed token/consent/grants endpoints, user + managed layers resolved via TrustedGatewayLayers. Issuer is shared with the gateway; only the audience differs (gateway vs platform).

2. Platform-audience token from the feat(#455 slice 2): native OIDC GatewayTokenProvider (auth-code+PKCE / device-code / client_credentials) #490 GatewayTokenProvider — reuse the cached refresh to acquire a token the managed platform accepts (add a platform aud/scope to the login, or a sibling PlatformTokenProvider over the same store). feat(#455 slice 2): native OIDC GatewayTokenProvider (auth-code+PKCE / device-code / client_credentials) #490's "openai-only, never sign in against the anthropic public URL" guardrail is gateway-specific and does not constrain a platform-aud token.

3. Automatic, file-based delivery (chosen approach). forge auth login + forge mcp connect persist resolved MCP state (platform base_url + token/refresh + resolved connections) under ~/.forge/…. Both forge-core and the initializ Strands SDK read it as a fallback source; precedence is env > file so CI/deploy still win via env. After login + connect, running the agent "just works" — no eval, no export — and the file is re-read each run so token refresh is never stale. forge mcp env remains the CI / other-shell escape hatch (a child process can't mutate the parent shell's env, which is why the file is the automatic path).

4. forge mcp list / forge mcp connect — list shows the dev's workspace-granted connections from the platform (merged with local forge.yaml, tagged by source + mode). connect reuses forge mcp login's browser/PKCE machinery but targets the platform connect flow so the refresh token is vaulted platform-side, not stored locally.

5. Direct-vs-platform switch — no platform URL → direct types only (oauth/bearer/static, works standalone/OSS); platform URL set → workspace grants resolve platform/user via the managed resolver. auth.type stays the per-connection signal; platform-config presence gates the platform modes (a direct block remains usable as an OSS fallback).

Platform-side dependency (tracked separately)

The type: user (delegated) tokens for a developer's own identity are minted by the managed platform, not by forge. That platform-side work — accepting a verified developer identity and minting a delegated token scoped to the caller's own grant — is tracked in the platform (agent-builder) backlog and has its own authorization prerequisite that must land first. It is out of scope for this forge issue beyond the client contract (endpoints + request shape) that #490 already establishes. This issue can be built and merged against a stub/mock of that endpoint; end-to-end delegated dev flow lights up once the platform side ships.

Acceptance criteria

• forge auth login (feat(#455 slice 2): native OIDC GatewayTokenProvider (auth-code+PKCE / device-code / client_credentials) #490) → forge mcp connect X → running the agent brokers X as the developer, with no env export (against the managed endpoint or a mock).
• The platform (agent-principal) and asserted-subject deployed paths are unchanged (regression-tested).
• forge-core and the Strands SDK read the ~/.forge file as a fallback; env wins when set.
• forge mcp list shows workspace-granted connections when a platform URL + login are present.
• Standalone/OSS (no platform URL) still resolves direct oauth/bearer/static connections unchanged.

Touch points (forge)

• forge-core/llm/oauth + settings (built in feat(#455 slice 2): native OIDC GatewayTokenProvider (auth-code+PKCE / device-code / client_credentials) #490)
• forge-cli/cmd/{auth_gateway,mcp_list,mcp_login}.go (+ a mcp connect and the ~/.forge file persistence)
• initializ Strands SDK config loader (~/.forge fallback) — external repo, coordinated

Depends on

• feat(#455 slice 2): native OIDC GatewayTokenProvider (auth-code+PKCE / device-code / client_credentials) #490 (native OIDC login)
• Platform-side managed delegated-token endpoint for developer identity + its authz prerequisite (tracked in the platform backlog) — required for the end-to-end delegated dev flow