feat(spore): add MCP reverse proxy with OAuth via Pocket ID

[stackptr]

Summary

• Add mcp.zx.dev nginx vhost on spore that reverse proxies to MCPJungle on glyph (port 8090 via Tailscale)
• Serve /.well-known/oauth-protected-resource per the MCP auth spec, pointing Claude to Pocket ID as the authorization server
• Return MCP-spec-compliant 401 responses with WWW-Authenticate header for unauthenticated requests
• Enable JWT Bearer token validation on oauth2-proxy (skip-jwt-bearer-tokens) so it can validate tokens from Pocket ID

Setup required before deploying

1. Register a client in Pocket ID with redirect URIs:
   • https://claude.ai/api/mcp/auth_callback
   • https://claude.com/api/mcp/auth_callback
2. Update extra-jwt-issuers audience in auth.nix to match the actual Pocket ID client ID
3. Verify *.zx.dev DNS wildcard covers mcp.zx.dev (or add an explicit record)
4. In Claude custom connector settings, provide the Pocket ID client ID and secret

Test plan

• Deploy to spore with nixos-rebuild switch
• Verify https://mcp.zx.dev/.well-known/oauth-protected-resource returns correct JSON
• Verify unauthenticated requests to https://mcp.zx.dev/mcp return 401 with WWW-Authenticate header
• Register Pocket ID client and update extra-jwt-issuers
• Add custom connector in Claude and verify OAuth flow completes
• Verify MCP tools are accessible through the connector

🤖 Generated with Claude Code