feat: fetch OpenAPI spec from R2 binding instead of bundling - #11

Summary

• Removes the 45MB bundled spec from the worker. The processed OpenAPI spec (with all $refs resolved) was previously imported at build time and embedded into every deployment.
• Stores the spec in R2, read directly via the SPEC_BUCKET R2 binding — no HTTP routes or caching layer needed.
• Adds a daily cron trigger (0 0 * * * UTC) with a scheduled() handler that fetches the latest spec from GitHub, resolves $refs, and writes both spec.json and products.json to R2.
• Extracts shared spec processing into src/spec-processor.ts with full test coverage.
• Makes account_id optional in the execute tool — auto-selects for single-account users, shows a picker for multi-account (incorporates fix: account ID negotiation for multi-account OAuth users #8).
• Cleans up OAuth scope templates — removes broken security-full and full-access templates, trims read-only to essential scopes. See OAuth fails when too many scopes are requested #12 for the scope limit issue.
• Adds OPENAPI_SPEC_URL as an environment variable across all environments.
• Adds R2 seed script (scripts/seed-r2.ts) for populating staging/production R2 buckets.

How it works

Cron (daily midnight UTC)
  → fetch raw spec from GitHub
  → resolve $refs, extract products
  → write spec.json + products.json to R2

Search request
  → env.SPEC_BUCKET.get('spec.json')
  → spec text passed to sandbox worker for search execution

Server startup
  → env.SPEC_BUCKET.get('products.json')
  → product list used in search tool description

Closes #8

Test plan

• All 68 tests pass (npm run check)
• TypeScript compiles cleanly
• Deployed to staging, search + execute tools verified
• R2 buckets created and seeded (mcp-spec-staging)
• OAuth flow works with read-only, workers-full, dns-full templates