[Refactor] Centralize native MCP authentication policy

[roomote-roomote]

​Created by Roomote. View the task or mention @roomote-roomote for follow-up asks.

What changed

• Added one shared authorization resolver for deployment-scoped native MCP handlers.
• Routed Asana, Grafana, Granola, Notion, Snowflake, and Vercel through the shared missing-auth, run-token, and user-auth policy while leaving provider credential resolution unchanged.
• Replaced repeated authorization contract cases with one parameterized suite covering all six providers, while retaining focused provider behavior and credential tests.

Why this change was made

The same authorization invariant had six independent implementations and synchronized test copies. Centralizing it gives the policy one owner and reduces the risk that a future provider change drifts from the others.

Impact

There is no intended user-facing behavior change. Existing public authorization errors and provider-specific credential lookup remain unchanged, while the native MCP authorization policy is easier to maintain consistently.

[roomote-community]

No code issues found. See task

_{Reviewed 3cab27c}