MCP OAuth works with Keycloak and hosted redirects

MCP access can now use the OAuth proxy with Keycloak as well as hosted identity providers, including deployments where the browser-facing realm URL differs from the in-cluster Keycloak URL. Hosted client redirect URIs are also accepted, improving compatibility for AI agent clients that connect through OAuth. See [[feature:ol-next-mcp-server|MCP server for AI agents]].