fix(security): refuse OAuth authorize/consent for users without access (audit L1)

mcp-oauth has no filter for this, so AuthorizeGate runs on
template_redirect before its router and stops the browser endpoints
(authorize, authorize-callback, consent) for logged-in users without
lit_mcp_use with "Dein Benutzer hat keinen Zugriff auf LIT MCP." (403).
Login redirect, token and revoke stay mcp-oauth's.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7

src/Plugin.php

@@ -30,6 +30,7 @@ use LIT\MCP\Integrations\WordPress\Schema\ContentSchema;
 use LIT\MCP\Integrations\WordPress\Schema\RegisteredMetaSource;
 use LIT\MCP\Integrations\WordPress\Schema\SampledMetaSource;
 use LIT\MCP\Integrations\WordPress\WordPressIntegration;
+use LIT\MCP\Server\AuthorizeGate;
 use LIT\MCP\Server\DiscoveryCanonical;
 use LIT\MCP\Server\RequestContext;
 use LIT\MCP\Server\ServerRegistrar;
@@ -60,6 +61,7 @@ final class Plugin
         (new RequestContext())->register();
         (new VisibilityFilter())->register();
         (new DiscoveryCanonical())->register();
+        (new AuthorizeGate())->register();
 
         $limits = new Limits();
         $changeLog = new ChangeLog();