Accept access tokens from the configured identity provider on the API (token exchange / service acting as a user)

What: let a self-hosted Outline accept, on the API, a short-lived JWT issued by a trusted OIDC provider (validated against the provider's JWKS, fixed issuer + audience), mapped to an existing user by email. Why: we run Outline behind an IdP (Authentik) with OIDC sign-in. A family assistant (an MCP server) needs to read and write pages *as the signed-in person*, so Outline's own permissions still decide what that person can see. Today the only options are a personal API key per person (long-lived, handed out manually, has to be stored by the service, which then holds keys for everyone) or the OAuth provider built into Outline (an interactive consent flow per person, which the IdP already did). The IdP can already mint a 10-minute token for "Outline, as this person" (token exchange / federated client credentials), and refuses people who aren't allowed into the app. Outline just can't accept it, because the API only takes tokens it issued itself. Proposal …