refactor: source OAuth proxy from shared bes-mcp-oauth package

[julianam-w]

Summary

Extracts the Google OAuth proxy (rag/oauth_proxy.py + rag/auth.py) into the
shared bes-mcp-oauth
package (v0.1.0) so every BES MCP server uses one implementation.
mcp_server.py now imports GoogleOAuthProxyProvider from the package, and the
two modules are removed here. This unblocks tupaia-metadata-mcp (and future
servers) reusing the same OAuth without copying code.

Net −476 / +14 lines: an added dependency + one import line, minus the two
relocated modules.

Test plan

• uv lock resolves bes-mcp-oauth @ v0.1.0 (added; 76 packages).
• uv sync --no-dev installs it from the tag.
• Import check passes: import mcp_server; from bes_mcp_oauth import GoogleOAuthProxyProvider, GoogleTokenVerifier — the provider resolves from bes_mcp_oauth.oauth_proxy, no ImportError.
• Not yet exercised: a live Google browser sign-in. Recommend a smoke test on the next Railway deploy from this branch before merge (import parity makes a regression unlikely).

Risk / rollback

Low — pure code relocation, no behaviour change; the package contains the same
code verbatim (only oauth_proxy.py's internal import made package-relative).
Rollback: revert this commit (restores the in-repo modules) and redeploy.