docs(api): update MCP signed-in auth to IAS native-HTTP OAuth

[jung-thomas]

What

Updates the /api-docs/ page so the MCP signed-in tier (/mcp-auth/*) documents the current production auth: SAP Identity Authentication Service (IAS), OAuth 2.1 authorization-code + PKCE, public client (no secret). Native-HTTP-OAuth MCP clients point straight at the mount — the old XSUAA + mcp-remote bridge instructions are gone.

Why

The page still described the pre-migration XSUAA/mcp-remote setup — it was supposed to be updated to the IAS way. This was caught while re-pointing the sap-developers-auth MCP server (in Claude Code) at production IAS.

Files

• hugo/content/api-docs/_index.md — MCP signed-in section prose (lines ~110, 113): IAS native-HTTP OAuth, .well-known discovery, Claude Code type: http config; no mcp-remote.
• hugo/data/api_endpoints.yaml — /mcp-auth/* row: auth → IAS (OAuth2 + PKCE), purpose rewritten. path + driftMarkers untouched.

Verification

• node scripts/check-api-docs-drift.cjs → OK (18 rows checked).
• Both files LF (no CRLF).
• IAS flow validated non-interactively against prod: authorize endpoint accepts client_id + PKCE (S256) + scope + redirect (HTTP 200 login form, no invalid_client). Only the human browser sign-in remains, which can't be scripted.

Scope / out of scope

• MCP only. A2A stays XSUAA client-credentials (confirmed still live on prod via its agent-card) — its section is intentionally unchanged. A2A→IAS migration tracked separately.