CTX7-2692: Support Vercel Marketplace OIDC in SDK and MCP

[fahreddinozcan]

Summary

• add an SDK authToken value/provider alongside API-key authentication
• resolve async token providers once per Context7 request so short-lived Marketplace credentials are refreshed instead of cached for the client lifetime
• validate Vercel Marketplace tokens at the MCP edge using the configured integration issuer JWKS, exact product audience, RS256, nbf/exp, and immutable resource claim
• document per-resource bearer-token use without depending on the not-yet-released Vercel token-minting API signature

Compatibility

• existing apiKey and CONTEXT7_API_KEY behavior is unchanged and takes precedence
• custom Authorization headers remain protected from override
• no production data or credentials are changed

Verification

• SDK: 40 tests, typecheck, ESLint, and tsup build
• MCP Marketplace auth: 17 tests, typecheck, ESLint, and TypeScript build
• git diff --check

Rollout dependency

The final Vercel Marketplace token-minting API is not yet available. The SDK accepts its short-lived bearer tokens through a stable provider callback; the README can be updated to the final Vercel helper signature once Vercel publishes it.

Linear: https://linear.app/upstash/issue/CTX7-2692/oidc-support

[linear-code]

CTX7-2692