fix: advertise refresh_token grant in OAuth DCR + add Miro MCP example

[aheritier]

What

Two related changes:

1. Fix OAuth Dynamic Client Registration (RFC 7591) to advertise both authorization_code and refresh_token grant types. Previously only authorization_code was declared, which strict authorization servers reject during registration:

   client registration failed with status 400: {"error":"invalid_client_metadata","error_description":"grant_types must be authorization_code and refresh_token"}
   

   docker-agent already uses the refresh-token grant (RefreshAccessToken), so declaring it at registration is correct and backwards-compatible with lenient servers (Notion, Atlassian). Adds a regression test asserting both grants are sent.

2. Add a Miro hosted MCP example (examples/miro-expert.yaml) demonstrating Miro's hosted MCP server (https://mcp.miro.com/) over streamable HTTP with OAuth 2.1 DCR. Includes four inline board skills (browse / diagram / doc / table) adapted from Miro's own skill set, a link to the official docs, and notes on the Enterprise-plan requirement. Registered in examples/README.md.

Why

The Miro MCP server (and any strict OAuth MCP server) is currently unusable via docker-agent's remote MCP support. The fix unblocks it; the example documents the working configuration end to end.

Testing

• task build, task test, task lint all pass
• New test TestRegisterClient_GrantTypesIncludeRefreshToken covers the fix
• examples/miro-expert.yaml validated with docker-agent run ... --dry-run
• Manually verified: the OAuth flow against mcp.miro.com now completes successfully

Closes #3191

[docker-agent]

Assessment: 🟢 APPROVE

The changes in this PR are correct and well-structured:

pkg/tools/mcp/oauth_helpers.go — The fix to advertise refresh_token alongside authorization_code in the DCR grant_types array is the right call per RFC 7591. Docker-agent already uses the refresh-token grant (RefreshAccessToken), so declaring it at registration is required for strict servers and harmless for lenient ones. No logic errors or correctness issues found.

pkg/tools/mcp/oauth_test.go — The new TestRegisterClient_GrantTypesIncludeRefreshToken test is well-structured, uses require/assert per project conventions, and correctly exercises the registration body content.

examples/miro-expert.yaml / examples/README.md — Documentation-only additions following the existing config schema and examples pattern. No issues.