feat: add Cloud Run + OAuth remote deployment (DGP-1236)

[AlexCostello91]

Port the google-ads-mcp remote deployment pattern (upstream PR googleanalytics#160), rebased onto v0.7.0 with security hardening:

• Migrate coordinator to FastMCP; register all 9 tools with ToolAnnotations(readOnlyHint=True)
• server.py: streamable-http on $PORT when OAuth env vars are set, stdio otherwise; uvicorn access logs disabled so OAuth callback URLs (authorization codes) never reach Cloud Logging; httpx logger silenced
• client.py: per-request OAuth token resolution that fails closed in HTTP mode (no silent fallback to server ADC); keeps prevent_stdio_inheritance() around google.auth.default()
• Replace google-adk dependency with fastmcp>=3.2.0
• Fix run_funnel_report Dict[str,str] hints -> Dict[str,Any] (schema compatibility with Claude Desktop; funnel_next_action takes int limit)
• Dockerfile: pinned uv image, non-root user; .dockerignore excludes credentials, env files, VCS metadata
• deploy/cloud-run.sh: two-phase Cloud Run deploy with the client secret sourced from Secret Manager
• Tests for tool registration, generated schemas, required fields, read-only annotations, and fail-closed credential behavior