Add SQLite storage backend for self-hosted deployments

[andrmnl]

Summary

Currently mcp-front supports two storage backends for OAuth state: memory (loses state on restart) and firestore (requires GCP). For self-hosted deployments without GCP, there's no persistent storage option.

This proposes adding SQLite as a third storage backend — a file-based, zero-dependency option that provides persistence without requiring any cloud services.

Motivation

Self-hosted users running mcp-front outside of GCP (e.g. on a VPS with Docker) currently have to choose between:

• memory: loses all OAuth clients and grants on container restart, forcing users to re-authorize
• firestore: requires a GCP project and Firestore setup, which is heavy for small deployments

SQLite fills the gap — persistent, encrypted at rest (using the existing encryptionKey mechanism), and requires only a file path.

Proposed behavior

• New storage: "sqlite" option in the OAuth auth config
• New sqlitePath field specifying the database file path (required when storage is "sqlite")
• Requires encryptionKey (same as Firestore) for encrypting sensitive fields (client secrets, tokens, identity data)
• Uses WAL journal mode and single-connection pool (appropriate for the low-concurrency OAuth use case)
• Implements the full Storage interface: clients, grants, user tokens, and sessions
• Uses pure-Go SQLite (modernc.org/sqlite) — no CGO required, works in scratch/distroless containers

Configuration example

{
  "auth": {
    "storage": "sqlite",
    "sqlitePath": "/data/mcp-front.db",
    "encryptionKey": "<32-byte-key>"
  }
}

[dgellow]

Excellent idea :)