Development interoperability fixture

Verified DocuJoint host embed

This separate HTTPS origin signs short-lived, non-identifying visitor claims. Its private key stays in the Worker secret store.

Verify external MCP OAuth