* feat(mcp): carry an absolute expiresAt on the OAuth authorization-url update
The authenticate flow waits for the OAuth callback with a fixed budget,
but the authorization-url tool update surfaced to embedding hosts did not
say when that window ends — hosts had to hardcode a mirror of the
15-minute constant to render countdowns. Include the absolute deadline
(now + effective wait timeout) in the update payload for v1 and v2.
Resolve#2607
* fix(protocol,kap-server): accept expiresAt in the OAuth authorization-url update schemas
The zod validators mirrored the pre-expiresAt payload shape and would
strip the new field at the kap-server boundary.
---------
Co-authored-by: zouying <zouying@moonshot.cn>
3126422757