Edit authorization is permission-based without ownership checks

[singh-priyanshi14014]

Describe the bug
MCP Registry currently uses permission-based authorization for editing servers but does not track or enforce ownership. As a result, any user with matching edit permissions can edit any server, even if they did not create it.
It creates serious risks for multi-tenant or public registry use cases and is not clearly documented.

To Reproduce
Steps to reproduce the behavior:

1. Configure MCP Registry with global edit permissions
2. User A publishes a server
3. User B authenticates with a valid OIDC token
4. User B edits User A’s server, with User A's server name that match the Permission[]
5. Edit request succeeds

Expected behavior

• A user can edit a server only if they are the creator, OR
• The user has explicit admin-level permissions (e.g. *)
• Ownership should be persisted and auditable

Logs
No logs available.

Additional context
Suggested Improvements (High-level)

• Add ownership tracking
• Store created_by (OIDC sub) when a server is published
• Enforce ownership on edits

Allow edit if:

• user is the creator, OR
• user has admin-level permissions (e.g. *)
• Add audit logging

Track:

• who created a server
• who modified it
• timestamps