fix: await verifyAccessToken in MCP middleware

verifyAccessToken is async and returns a Promise. Without await,
the Promise object is always truthy, so any Bearer token (even
invalid ones) was accepted. This fixes MCP OAuth authentication.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/server/index.ts

@@ -1,5 +1,6 @@
 import { Hono } from "hono";
 import { serveStatic } from "hono/bun";
+import { cors } from "hono/cors";
 import { db as prodDb } from "../db/index.ts";
 import { seedDefaults } from "../db/seed.ts";
 import { mcpRoutes } from "./mcp/index.ts";
@@ -34,6 +35,11 @@ app.get("/api/health", (c) => {
 	return c.json({ status: "ok" });
 });
 
+// CORS for OAuth and MCP endpoints (required for claude.ai browser-based flows)
+app.use("/.well-known/*", cors());
+app.use("/oauth/*", cors());
+app.use("/mcp/*", cors());
+
 // OAuth routes (must be before /api/* middleware)
 app.use("/oauth/*", async (c, next) => {
 	c.set("db", prodDb);

src/server/mcp/index.ts

@@ -99,7 +99,7 @@ mcpRoutes.use("/*", async (c, next) => {
 	const authHeader = c.req.header("Authorization");
 	if (authHeader?.startsWith("Bearer ")) {
 		const token = authHeader.slice(7);
-		if (verifyAccessToken(db, token)) {
+		if (await verifyAccessToken(db, token)) {
 			return next();
 		}
 		return c.json({ error: "invalid_token" }, 401);