feat: add setup, browser login, and an install homepage

setup registers or logs in and writes ~/.verae/auth.properties
without printing the JWT. A caller bearer is used for stamp and
verify instead of the host login. VERAE_MCP_OAUTH=1 serves the
browser account page. site/index.html is the public install guide.

README.md

@@ -6,8 +6,40 @@ Verae MCP timestamping server. Hash-only stamps via leaf locald/NATS.
 
 The MCP process never hashes content. Clients send a SHA-256 hex digest. `scope=local` writes `~/.verae/mcp-timestamp-local.json`. `scope=global` POSTs to `https://api.veraetime.net/api/timestamp` (same wire as `verae-timestamp/global.Client`). `want_scope=global` verifies against that API as the central source of truth. `signup` creates a `user` account with no existing session. `login` stores the VeraeTime JWT on this host. `session` checks it. `create_user` adds an account when that JWT is an admin.
 
+## Table of Contents
+
+- [Install](#install)
+- [Usage](#usage)
+- [Contributing](#contributing)
+- [License](#license)
+
 ## Install
 
+On the machine that will run the server:
+
+```sh
+uvx verae-mcp-timestamping-server setup
+```
+
+`setup` asks whether this is a new account or an existing one, then writes `~/.verae/auth.properties` (mode 600). It prints the username, role, and expiry. It does not print the token. `uvx verae-mcp-timestamping-server session` prints the same check.
+
+Assistant config names the command or the public URL. It does not contain the token:
+
+```json
+{
+  "mcpServers": {
+    "verae-timestamping": {
+      "command": "uvx",
+      "args": ["verae-mcp-timestamping-server"]
+    }
+  }
+}
+```
+
+For the public server, set `url` to `https://mcp.veraetime.net/mcp`. With `VERAE_MCP_OAUTH=1` and `VERAE_MCP_PUBLIC_URL=https://mcp.veraetime.net`, the first connection opens a browser page to create an account or log in. The assistant stores that token in its own OAuth file.
+
+Development checkout:
+
 ```sh
 cd /Users/marchon/research/modelcontextprotocol/verae-mcp-timestamping-server
 uv sync --group dev
@@ -59,10 +91,11 @@ open docs/html/index.html
 
 Sources: `docs/operator-guide.md`, `docs/architecture.md`, `docs/api.md`, `docs/standards.md`.
 
-Sample page (talks to Streamable HTTP on this machine):
+Install page and stamp sample:
 
 ```sh
 open site/index.html
+open site/sample.html
 ```
 
 Public copy of the page and the docs: `https://mcp.georgelambert.org/`.