feat: requires OAuth-only auth mode for MCP agents

tests/test_config.py

@@ -1,3 +1,6 @@
+import pytest
+from pydantic import ValidationError
+
 from app.config import Settings
 
 
@@ -11,3 +14,8 @@ def test_numeric_crawl_limit_is_parsed():
     settings = Settings(crawl_limit="25")
 
     assert settings.crawl_limit == 25
+
+
+def test_mcp_auth_mode_rejects_oauth_or_token_fallback():
+    with pytest.raises(ValidationError):
+        Settings(mcp_auth_mode="oauth_or_token")