pt-spike-mcp: throwaway OAuth spike. Nothing to see here.