fix: make external OAuth authorization configurable

[FreeOnePlus]

Summary

• replace external OAuth role, permission, security-level, and trusted-domain
  hardcoding with validated configuration
• add environment settings for default roles/permissions, role mappings,
  trusted domains, and fallback security levels
• require email_verified=true before a trusted email domain can elevate a
  user's security classification
• remove placeholder trusted domains and make permission output deterministic
• replace the misleading Python-only README example with deployable
  environment configuration and Doris authorization boundaries

Configuration

The new settings are:

• OAUTH_DEFAULT_ROLES
• OAUTH_DEFAULT_SECURITY_LEVEL
• OAUTH_DEFAULT_PERMISSIONS
• OAUTH_TRUSTED_DOMAINS
• OAUTH_TRUSTED_DOMAIN_SECURITY_LEVEL
• OAUTH_ROLE_SECURITY_LEVELS_JSON
• OAUTH_ROLE_PERMISSIONS_JSON

JSON mappings replace the complete built-in mapping when supplied. An explicit
empty permission array denies permissions for that mapped role, and an empty
OAUTH_DEFAULT_PERMISSIONS value makes unknown roles fail closed.

Root cause

The README described authorization as configurable, but the active external
OAuth provider embedded role mappings and placeholder trusted domains directly
in Python. Operators could not supply their own roles or safely disable the
implicit read_data fallback.

Validation

• uv run pytest -q: 1090 passed, 68 skipped; coverage 58.11%
• external OAuth configuration and validation suite: 49 passed
• post-rebase OAuth/result-limit regression set: 62 passed
• uv run ruff check .
• uv run mypy doris_mcp_server
• CI-equivalent Bandit scan
• uv build

Fixes #88