fix: parse documented [server] auth_* config keys without dropping or mangling

[AutomateIP]

Summary

Fixes two coupled bugs in the config-file loader that broke the documented
file-based auth configuration path. docs/mcp.conf.example documents all
auth fields under [server] with an auth_* prefix, but those keys were
being silently dropped, and oauth_* field names were being mangled.

Changes

• Reorder the section-dispatch loop in config/loaders.py so server_auth_/
  auth_ keys are matched before the broad server_ prefix. Previously the
  server_ branch absorbed every [server] auth_* key into server_data,
  where pydantic silently dropped them (dead server_auth_ branch).
• Add _strip_auth_prefix(), a prefix-only strip (removeprefix), replacing
  the global key.replace("auth_", "") that mangled all 8 oauth_* field
  names (e.g. oauth_client_id -> oclient_id).
• Add coverage in tests/test_config.py for the documented [server] auth_*
  path, the [auth] section, oauth field-name integrity, and confirmation
  that fix: config file values no longer override env vars and CLI flags #403's env/CLI-over-file precedence still holds.

Testing

• Unit tests pass (make ci, 2829 passed)
• Integration tests pass (live Itential Platform: AuthConfig populated
  from [server] auth_*, oauth_client_id not mangled, [auth] and
  [platform] paths unaffected, env-var precedence from fix: config file values no longer override env vars and CLI flags #403 preserved,
  live get_health succeeds)
• Fail-without-fix verified (20/28 new tests fail when the fix is reverted)

Related Issues

Addresses roadmap 0.14.0 Tier B #26 (documented [server] auth_* keys
silently absorbed/dropped) and #27 (oauth_* field names mangled by a global
string replace). Both surfaced during #403 and are fixed together as they
share the same dispatch/parsing path.