OAuth MCP sessions fixed; new guides for RSS, notifications

Added

• Docs site gains three how-to guides: locating a changelog source for a product, converting any changelog to an RSS/Atom feed, and setting up release notifications.

Fixed

• MCP clients can now complete OAuth authorization — resource-request validation was incorrectly blocking clients that hadn't pre-declared their target resource, and a column encoding bug was silently discarding scope grants on new OAuth client registrations.
• MCP OAuth sessions now issue refresh tokens so authenticated clients stay connected past the one-hour access-token expiry; concurrent token refreshes from multiple tabs or agent processes no longer trigger a forced re-authorization.