ci: raise the coverage gate to 90 percent; docs: reconcile OAuth docs with the implementation

docs/architecture.md

@@ -102,10 +102,12 @@ compared, so length does not leak). A match runs the call as `GITEA_TOKEN`, with
 resolved once from `GET /user`. stdio is always this mode.
 
 Per-user OAuth mode: the server is an OAuth 2.1 authorization server for MCP clients (dynamic
-client registration, PKCE) and a confidential OAuth client of Gitea. `/oauth/callback` receives
-Gitea's code, exchanges it, and issues the client opaque access and refresh tokens that map to
-the user's Gitea tokens. A call with such a token runs with the user's own Gitea access token,
-so Gitea enforces that user's permissions. The mapping lives in `DATA_DIR/oauth-tokens.json`
+client registration, PKCE) and a confidential OAuth client of Gitea. `/authorize` parks the
+request and shows the consent page `/oauth/consent` (client name, redirect URI, approval with
+CSRF and origin checks) before the browser goes to Gitea. `/oauth/callback` receives Gitea's
+code in the same browser, exchanges it, and issues the client opaque access and refresh tokens
+that map to the user's Gitea tokens. A call with such a token runs with the user's own Gitea access token,
+so Gitea enforces that user's permissions. The mapping lives in `DATA_DIR/oauth-store.json`
 (mode 0600). Gitea tokens in it are encrypted with Fernet (key derived from
 `TOKEN_ENCRYPTION_KEY`); our own tokens are stored as SHA-256 hashes. Upstream refresh is
 automatic.