Implement shared public MCP federation gateway

- full-vmcp serves as public entry point at mcp.ngorse.com
- Single Keycloak client (public-mcp) for all external tools
- authServerConfig proxies auth to Keycloak
- state-docs-vmcp becomes internal-only (no auth required)
- Shared OIDC config for token validation
- All external clients authenticate once at gateway

manifest/overlays/production/vmcp-servers/full-vmcp.yaml

@@ -21,16 +21,15 @@ spec:
   incomingAuth:
     type: oidc
     oidcConfigRef:
-      name: full-vmcp-oidc
-      audience: http://full-vmcp.toolhive-system.svc.cluster.local:4483
+      name: public-mcp-oidc
   authServerConfig:
-    issuer: https://full-vmcp.ngorse.com
+    issuer: https://mcp.ngorse.com
     upstreamProviders:
       - name: keycloak
         type: oidc
         oidcConfig:
           issuerUrl: https://cloak.olb42.com/realms/home-lab
-          clientId: toolhive-full-vmcp
+          clientId: public-mcp
   config:
     aggregation:
       conflictResolution: prefix