[im-rk]

Alexa+ MCP Toolkit requires OAuth 2.1 + PKCE; the server only had a static bearer token.

• Authorization server: discovery documents (RFC 9728 and server metadata), /oauth/authorize with a family link-code page, /oauth/token (authorization_code and refresh_token), S256 only, resource parameter, static client, signed stateless tokens, single-use codes, rate-limited and audited link attempts.
• Safety: an assistant token is bound to one household and cannot call resolve_approval or set_policy.
• With OAuth on, the unauthenticated 401 carries no WWW-Authenticate header (Alexa+ requirement). OAuth is off unless OAUTH_CLIENT_ID is set.
• FIXED_NOW (non-production) freezes the server clock; fixes a simulator test that failed at night.
• docs/alexa-integration.md states plainly that a live Alexa+ connection is NOT done, with the steps; alexa-addon/addon.json template.

264 node + 33 web + 17 browser tests pass.