feat(auth): wire GoogleProvider into FastMCP, log auth status on startup

- Call _build_google_auth() at module level before mcp = FastMCP(...)
- Pass auth=_google_auth to FastMCP() constructor
- Add startup log in run_server(): INFO when OAuth enabled (with redirect URI), WARNING when open/unauthenticated
- Add test verifying mcp has no auth provider when Google vars are absent (baseline + post-wire)

unraid_mcp/server.py

@@ -117,11 +117,15 @@ def _build_google_auth() -> "GoogleProvider | None":
     return GoogleProvider(**kwargs)
 
 
+# Build auth provider — returns GoogleProvider when configured, None otherwise.
+_google_auth = _build_google_auth()
+
 # Initialize FastMCP instance
 mcp = FastMCP(
     name="Unraid MCP Server",
     instructions="Provides tools to interact with an Unraid server's GraphQL API.",
     version=VERSION,
+    auth=_google_auth,
     middleware=[
         _logging_middleware,
         error_middleware,
@@ -181,6 +185,19 @@ def run_server() -> None:
             "Only use this in trusted networks or for development."
         )
 
+    if _google_auth is not None:
+        from .config.settings import UNRAID_MCP_BASE_URL
+
+        logger.info(
+            "Google OAuth ENABLED — clients must authenticate before calling tools. "
+            f"Redirect URI: {UNRAID_MCP_BASE_URL}/auth/callback"
+        )
+    else:
+        logger.warning(
+            "No authentication configured — MCP server is open to all clients on the network. "
+            "Set GOOGLE_CLIENT_ID + GOOGLE_CLIENT_SECRET + UNRAID_MCP_BASE_URL to enable OAuth."
+        )
+
     logger.info(
         f"Starting Unraid MCP Server on {UNRAID_MCP_HOST}:{UNRAID_MCP_PORT} using {UNRAID_MCP_TRANSPORT} transport..."
     )