[AvianJay]

Adds standard Streamable HTTP tools for Taiwan bus searches, stops, realtime arrivals, alerts and schedules. /mcp/public works anonymously; /mcp links a YABus account and reads only that user's cloud-synced favorites, including paginated favorite arrival queries.

OAuth uses the MCP SDK's authorization-code/PKCE flow with persistent SQLite clients, hash-only credentials, browser-bound Google/Discord login, explicit consent, account/resource-scoped tokens, refresh and immediate revocation. Public-client refresh tokens rotate with reuse detection; confidential clients support persistent linking. The account page links to authorization management. Application sessions never become AI credentials. OAuth query parameters are stripped from Uvicorn access logs.

MCP.md covers deployment, ChatGPT/Claude setup, Gemini preview enrollment, synchronization semantics and limitations. Companion Android integration: YetAnotherBusDeveloper/yetanotherbusapp#115. This PR implements the server; it does not deploy it or claim live platform certification.

Validation:

• Final offline suite: 407 tests and 669 subtests passed. Two existing live TDX probe scripts are excluded because they require TDX credentials.
• Includes 13 MCP integration/security cases: actual JSON-RPC discovery/calls, PKCE, account/client isolation, resource binding, expiry, consent CSRF, public refresh rotation/reuse detection, confidential persistent refresh, revocation, malformed registration, and favorite source timestamps/intercity mapping.
• Ruff checks and git diff --check passed.
• Google/Discord and ChatGPT/Claude/Gemini live linking still require the deployed endpoint and platform accounts.