feat(auth): expose access token subject

[MukundaKatta]

Summary

• Add optional subject and claims fields to AccessToken so token verifiers can preserve JWT sub and custom claims.
• Expose Context.subject for higher-level MCP handlers that need the authenticated subject.
• Add focused tests for auth-context propagation and the Context.subject convenience property.

Refs #1038.

Validation

• uv run pytest tests/server/auth/middleware/test_auth_context.py tests/server/mcpserver/test_server.py::test_context_subject_reads_authenticated_access_token -q
• uv run ruff format --check src/mcp/server/auth/provider.py src/mcp/server/mcpserver/context.py tests/server/auth/middleware/test_auth_context.py tests/server/mcpserver/test_server.py
• uv run ruff check src/mcp/server/auth/provider.py src/mcp/server/mcpserver/context.py tests/server/auth/middleware/test_auth_context.py tests/server/mcpserver/test_server.py