Fix all five findings from the independent OAuth security audit

An independent model reviewed the MCP and OAuth surfaces. All five findings
were verified against the code before changing anything; none were false
positives. audit.md is kept as the record of what was reviewed.

F1 (High) - refresh reuse detection forgot the token family. Only the current
hash and one predecessor lived on the grant, and each rotation overwrote the
predecessor. A thief who rotated a stolen token twice made the victim's
original unrecognisable: replaying it returned "unknown token" instead of
revoking the family, and the thief kept working. Refresh tokens are now rows in
OAuthRefreshToken, one per generation, retained for the life of the family and
consumed by a guarded update on usedAt - which also means two concurrent uses
of the same token can no longer both succeed. This corrects a claim I made when
the OAuth server shipped: reuse detection covered one generation, not the family.

F2 (Medium) - issueAccessToken wrote scopes back onto the grant, so redeeming a
stale authorization code redefined standing consent. Token issuance is not
consent; the consent endpoint is now the only writer. Codes are additionally
bound to a grant id and epoch, with a coversScopes check behind that.

F3 (Medium) - revocation was reversible. Reconnecting a disconnected app cleared
revokedAt and left credentials that had raced the revoke usable again. Every
approval now starts a clean epoch: the counter advances and prior access tokens,
refresh tokens and unconsumed codes are destroyed. Token writes are conditional
on the epoch they validated, so a revoke that wins a race aborts them. Refresh
also now requires offline_access to still be granted.

F4 (Medium) - loopback redirect matching compared only scheme, host and path,
silently accepting a differing query, fragment or userinfo. RFC 9700 2.1 wants
exact matching apart from the RFC 8252 port exception; that is what it does now.

F5 (Low) - get_collection_stats returned bar and recipe counts under
drinks:read. Gated on the caller actually holding bar:read.

Verified with regression tests for each: the two-rotation attack now revokes the
family, concurrent refresh yields exactly one winner, a pre-narrowing code is
refused, disconnect-reconnect leaves old credentials dead, and Claude Code's
ephemeral-port callback still works while query/userinfo/fragment variants are
rejected. Existing protections re-checked - code replay, PKCE mismatch, deny,
confidential-client rejection, and the MCP tools themselves.

Note for deploy: OAuthAuthCode gains a required grantId, so existing rows must
be cleared first. They are 60-second ephemeral codes.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01W1Ee4Mc1X1SX8HgYa52zu7

prisma/schema.prisma

@@ -208,6 +208,12 @@ model OAuthAuthCode {
   codeHash            String    @unique
   clientId            String
   userId              String
+  /// The grant, and the epoch of that grant, this code was authorized against.
+  /// Without both, a code is bound only to (client, user): one minted under a
+  /// broad consent stays redeemable after the user narrows or revokes and
+  /// re-grants, carrying the old scopes with it.
+  grantId             String
+  grantEpoch          Int       @default(0)
   /// Exactly what was sent to /oauth/authorize - re-checked at the token endpoint
   redirectUri         String
   /// RFC 8707 audience binding
@@ -221,8 +227,10 @@ model OAuthAuthCode {
 
   client OAuthClient @relation(fields: [clientId], references: [id], onDelete: Cascade)
   user   User        @relation(fields: [userId], references: [id], onDelete: Cascade)
+  grant  OAuthGrant  @relation(fields: [grantId], references: [id], onDelete: Cascade)
 
   @@index([userId])
+  @@index([grantId])
   @@index([expiresAt])
 }
 
@@ -232,27 +240,58 @@ model OAuthGrant {
   id       String   @id @default(cuid())
   clientId String
   userId   String
+  /// Written ONLY by the consent endpoint. Token issuance must never rewrite
+  /// standing consent - doing so let a stale authorization code redefine what
+  /// the user had most recently agreed to.
   scopes   String[]
 
-  refreshHash      String?   @unique
-  /// One generation back. A hit here means a rotated token was replayed, which
-  /// is a theft signal - revoke the whole grant rather than issuing again.
-  refreshPrevHash  String?
-  refreshExpiresAt DateTime?
+  /// Bumped every time consent is re-granted after a revocation. Codes and
+  /// refresh tokens carry the epoch they were issued under, so anything minted
+  /// before a revoke is dead even if the grant row is later reactivated.
+  epoch Int @default(0)
 
   revokedAt  DateTime?
   lastUsedAt DateTime?
   createdAt  DateTime  @default(now())
   updatedAt  DateTime  @updatedAt
 
-  client       OAuthClient      @relation(fields: [clientId], references: [id], onDelete: Cascade)
-  user         User             @relation(fields: [userId], references: [id], onDelete: Cascade)
-  accessTokens McpAccessToken[]
+  client        OAuthClient         @relation(fields: [clientId], references: [id], onDelete: Cascade)
+  user          User                @relation(fields: [userId], references: [id], onDelete: Cascade)
+  accessTokens  McpAccessToken[]
+  authCodes     OAuthAuthCode[]
+  refreshTokens OAuthRefreshToken[]
 
   @@unique([clientId, userId])
   @@index([userId])
 }
 
+/// One row per issued refresh token, retained after use.
+///
+/// The previous design kept only the current hash and one predecessor on the
+/// grant, so each rotation erased the generation before last. A thief who
+/// rotated a stolen token twice made the victim's original token unrecognisable:
+/// replaying it returned "unknown token" instead of revoking the family, and the
+/// thief kept working. Keeping every generation is what makes reuse detectable
+/// for the life of the family (RFC 9700 4.14.2).
+///
+/// Consumed with a guarded update on usedAt, so two concurrent uses of the same
+/// token cannot both succeed.
+model OAuthRefreshToken {
+  id         String    @id @default(cuid())
+  grantId    String
+  tokenHash  String    @unique
+  generation Int       @default(0)
+  /// Set the moment it is redeemed. A second presentation is reuse.
+  usedAt     DateTime?
+  expiresAt  DateTime
+  createdAt  DateTime  @default(now())
+
+  grant OAuthGrant @relation(fields: [grantId], references: [id], onDelete: Cascade)
+
+  @@index([grantId])
+  @@index([expiresAt])
+}
+
 model Account {
   id                String  @id @default(cuid())
   userId            String