Add OmniBrain MCP gateway authorization stub

[wmeddie]

Summary

• Add a dependency-free fixture-backed OmniBrain MCP gateway stub with opaque token introspection, per-tool authorization, safe-denial responses, permission-filtered retrieval, revocation helpers, and redacted audit logging.
• Expose stable MCP tool discovery metadata for omnibrain.search, omnibrain.get_document, omnibrain.list_scopes, and omnibrain.explain_access.
• Add deterministic tests covering allowed access, restricted metadata non-leakage, token/grant/source revocation, stale ACLs, tenant isolation, tool authorization, and filter validation.

Verification

• python -m py_compile omnibrain_mcp_gateway.py tests/test_omnibrain_mcp_gateway.py
• python -m pytest tests/test_omnibrain_mcp_gateway.py -q (14 passed)

Note: This is a stub/contract slice intended for review and future transport/runtime adapter integration.