codeSplitters: Executor todos (live hookup, OAuth sign-in, own MCP endpoint) #411

Follow-up to #383 / #389. The API spec and personal tokens are live and verified (#389), and Executor passed against a local build. What's left with Executor, all optional:

• Hook Executor up to the live site (just setup, no code):
  1. npm install -g executor, then executor web.
  2. Add Integration → https://codesplitters.notryanquinn.workers.dev/api/openapi.json.
  3. Add account → paste a codeSplitters token. Make a new one on your profile page; don't reuse the "claude code" one.
  4. Policies: codesplitters.* → approve; repos.deleteRepo, branches.mergeBranch, files.commitFile, deploys.deploy → require approval.
  5. npx add-mcp http://127.0.0.1:4788/mcp --transport http --name executor, then restart the agent.
• OAuth sign-in for Executor (code): let Executor's Add account open a codeSplitters sign-in page instead of a copied token. That means OAuth 2 authorize and token endpoints, plus the oauth2 security scheme in /api/openapi.json. It needs a security pass like codeSplitters: OpenAPI spec + personal API tokens, so outside agents (e.g. via Executor) can use the app #383's: scopes, expiry, refresh, revoking from the profile page.
• codeSplitters as its own MCP server (code): a /mcp endpoint, authed with the same tokens, so agents can plug in with no gateway, the way the page's WebMCP tools already work in the browser.

Notes from the local run (#389): Executor's previewSpec takes the spec as a string, but addSpec needs {kind: "url", url}. Executor also gates every non-GET call behind approval by default.