Implement shared public MCP federation gateway

- full-vmcp serves as public entry point at mcp.ngorse.com
- Single Keycloak client (public-mcp) for all external tools
- authServerConfig proxies auth to Keycloak
- state-docs-vmcp becomes internal-only (no auth required)
- Shared OIDC config for token validation
- All external clients authenticate once at gateway

manifest/overlays/production/vmcp-servers/kustomization.yaml

@@ -4,8 +4,8 @@ kind: Kustomization
 namespace: toolhive-system
 
 resources:
+  - oidcconfig-public-mcp.yaml
   - oidcconfig-state-docs-vmcp.yaml
-  - oidcconfig-full-vmcp.yaml
   - full-vmcp.yaml
   - full-vmcp-ingress.yaml
   - full-vmcp-ngorse-ingress.yaml