Expose the upstream refresh guard opt-out in RunConfig and CRDs #6931

Problem

#6930 adds a built-in upstream refresh guard to the embedded auth server (pkg/authserver). It refuses a refresh_token grant with invalid_grant when the token session's upstream credential is definitively dead. The guard is on by default. The only opt-out, authserver.Config.DisableUpstreamRefreshGuard, is a Go field. runner/embeddedauthserver.go never sets it, so thv, vMCP and the operator always run the guard.

With the guard on, a refresh token stays useful only while the upstream credential does. That holds even in deployments whose resource server never reads upstream tokens. An operator who wants the old behaviour has no switch.

Proposal

Expose the opt-out through the RunConfig embedded auth server config and the operator CRDs (MCPExternalAuthConfig / VirtualMCPServer embedded auth server settings), and wire it to Config.DisableUpstreamRefreshGuard.

Acceptance criteria

• A RunConfig field disables the guard for thv and the proxy runner.
• The operator CRDs expose the same field, with generated CRD docs.
• docs/arch/11-auth-server-storage.md ("Upstream refresh guard", Opt-out) no longer says the switch is Go-only.

Context

• Raised in review of Refuse refresh grants whose upstream credential is dead #6930.
• Parent issue: authserver: let embedders validate refresh-token grants, and type upstream refresh rejections #6901.