fix(mcp): advertise Apache identity in OAuth DCR

[wutongyuonce]

Summary

MCP OAuth dynamic client registration still advertised the pre-Apache GitHub org and always set software_id to maka-desktop. Consent screens and IdP policy that key off those fields therefore saw a stale identity.

This PR points client_uri at https://maka.apache.org/en/ and sets software_id to the running clientName (maka, maka-tui, or maka-desktop). Tokens, redirect URIs, and the authorization flow are unchanged.

Fixes #5072

Verification

• npm --workspace @maka/mcp run build && node --test packages/mcp/dist/__tests__/oauth.test.js — 39 passed
• Did not run root lint / format:check / full npm test

Review

Independent Codex review (read-only) found no must-fix issues. Follow-up: unit test now also locks redirect_uris and grant_types. Skipped extra desktop/TUI injection tests — caller chain already passes distinct clientName values.

AI use

Select exactly one:

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: Pi implemented the metadata change, tests, issue, and PR text. Codex ran a read-only review.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No