feat(auth): add subject field to AccessToken

[Sagargupta16]

Summary

Add an optional subject field to AccessToken for storing the JWT sub claim (user ID).

Motivation

Currently, token verifiers that decode JWTs have no standard way to pass through the subject/user identity. Consumers must re-decode the JWT to retrieve sub, duplicating work.

With this change:

class MyTokenVerifier:
    async def verify_token(self, token: str) -> AccessToken | None:
        claims = decode_and_validate_jwt(token)
        return AccessToken(
            token=token,
            client_id=claims["client_id"],
            scopes=claims["scope"].split(),
            subject=claims["sub"],
        )

Then downstream code can access the user ID directly:

from mcp.server.auth.middleware.auth_context import get_access_token
user_id = get_access_token().subject

Changes

• Added subject: str | None = None to AccessToken in provider.py
• Added test for backward compatibility (no subject) and with subject

Backward compatible - field defaults to None.

Fixes #1038