fix(mcp): URL-encode the registration id in the tenant-client lookup path

The registration lookup put a client_id-derived value into the backend URL
path unencoded. The amc_ regex already limits it to 32 hex characters, so
nothing changes at runtime, but every other request-derived path segment in
the MCP server goes through encodeURIComponent, and CodeQL counts only that
(or a ?/# prefix) as a request-forgery barrier - a regex capture group is
not one. Closes code-scanning alert js/request-forgery on oauth.ts.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

src/McpServer/autopilot-monitor-mcp/src/oauth.ts

@@ -605,7 +605,7 @@ async function lookupTenantClient(registrationId: string): Promise<TenantClient
 
   let res: Response;
   try {
-    res = await fetch(`${API_BASE_URL}/api/auth/mcp/client-registrations/${registrationId}`, {
+    res = await fetch(`${API_BASE_URL}/api/auth/mcp/client-registrations/${encodeURIComponent(registrationId)}`, {
       signal: AbortSignal.timeout(TENANT_CLIENT_LOOKUP_TIMEOUT_MS),
     });
   } catch {