feat(auth): expose OAuthProxy token expiry knobs as env vars

FastMCP's GoogleProvider accepts token_expiry_threshold_seconds and
fastmcp_access_token_expiry_seconds, but configure_server_for_http passes
neither, so a deployment cannot reach either without patching the server.

Both narrow the window in which two concurrent refreshes race on the same
refresh token. Rotation is one-time-use with no grace period, so the loser
is rejected with invalid_grant and the user is pushed through a full
re-authentication.

Unset, empty, non-integer and negative values keep FastMCP's own defaults,
so existing deployments are unaffected.

Signed-off-by: Ilia <ilia.lazebnik@gmail.com>