refactor(__main__): fix security issues, bugs, and reduce duplication (#609)

Security fixes:
- Hash OAuth client cache keys with SHA-256 to avoid raw tokens in dict keys
- Log only claim keys (not values) on OAuth credential errors
- Add threading.Lock to OAuthProxyClient for thread-safe cache access

Bug fixes:
- Add missing _cleanup_resources() call in OAuth shutdown path
- Split cleanup except blocks: ImportError (DEBUG) vs Exception (WARNING)
- Catch ValidationError directly in _create_server instead of broad Exception
- Add port validation in _get_http_runtime (invalid MCP_PORT now exits cleanly)

Deduplication (~140 lines removed):
- Extract _validate_standard_credentials() replacing 3 inline blocks
- Extract _get_show_banner() replacing 3 inline fastmcp imports
- Extract _setup_standard_mode() for main_web/main_sse credential+logging setup
- Extract _http_run_kwargs() for HTTP transport run_async configuration
- Extract _cancel_tasks() replacing 3 inline task cancellation loops
- Extract _run_with_shutdown() consolidating 3 shutdown orchestration copies
- Extract _run_entrypoint() consolidating 3 asyncio.run+exception patterns
- Move OAuth sentinel strings to config.py constants (OAUTH_MODE_URL/TOKEN)
- Remove redundant _DeferredMCP.run() method (__getattr__ already handles it)
- Use _get_http_runtime() in main_oauth() instead of duplicating env var reads

Author: sergeykad