Deduplicate server JSON structs between publisher and registry (#318)

<!-- Provide a brief summary of your changes -->

## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->

The following PR eliminates duplicate struct definitions by migrating
the publisher tool to use canonical types from pkg/model, creating a
single source of truth across the codebase. The publisher tool
previously had its own copies of structs that were duplicated, ie.
ServerJSON, Package, Repository, VersionDetail, EnvironmentVariable,
RuntimeArgument and a few others which was not optimal


**Changes in the PR:**
- Refactored the structs to single canonical types located at pkg/model
- Refactor the implementation to use/build canonical structures directly
  - Remove all duplicate definitions (5 structs eliminated)
- Publisher now uses model.ServerJSON, model.Package, model.Repository,
etc.
- Renamed some of the structs to better reflect their use case, i.e.
ServerJSON instead of ServerDetail
- Fixes an issue where the Remote property was missing from the previous
publisher copy of the Server

**Benefits:**
  - Single source of truth - Schema changes in one place
  - Type safety - Compiler catches mismatches
  - Enhanced validation - Field constraints and bson tags
  - Zero breaking changes - Same CLI interface and JSON output
  - Future-proof - New canonical fields automatically available

Supersedes: #217 and #240

## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->

Locally

## Breaking Changes
<!-- Will users need to update their code or configurations? -->
No

## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [x] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update

## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed

## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->

---------

Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>

internal/auth/jwt.go

@@ -10,7 +10,6 @@ import (
 
 	"github.com/golang-jwt/jwt/v5"
 	"github.com/modelcontextprotocol/registry/internal/config"
-	"github.com/modelcontextprotocol/registry/internal/model"
 )
 
 // PermissionAction represents the type of action that can be performed
@@ -31,9 +30,9 @@ type Permission struct {
 type JWTClaims struct {
 	jwt.RegisteredClaims
 	// Authentication method used to obtain this token
-	AuthMethod        model.AuthMethod `json:"auth_method"`
-	AuthMethodSubject string           `json:"auth_method_sub"`
-	Permissions       []Permission     `json:"permissions"`
+	AuthMethod        Method       `json:"auth_method"`
+	AuthMethodSubject string       `json:"auth_method_sub"`
+	Permissions       []Permission `json:"permissions"`
 }
 
 type TokenResponse struct {

internal/auth/jwt_test.go

@@ -11,7 +11,6 @@ import (
 	"github.com/golang-jwt/jwt/v5"
 	"github.com/modelcontextprotocol/registry/internal/auth"
 	"github.com/modelcontextprotocol/registry/internal/config"
-	"github.com/modelcontextprotocol/registry/internal/model"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -31,7 +30,7 @@ func TestJWTManager_GenerateAndVerifyToken(t *testing.T) {
 
 	t.Run("generate and verify valid token", func(t *testing.T) {
 		claims := auth.JWTClaims{
-			AuthMethod:        model.AuthMethodGitHubAT,
+			AuthMethod:        auth.MethodGitHubAT,
 			AuthMethodSubject: "testuser",
 			Permissions: []auth.Permission{
 				{
@@ -50,7 +49,7 @@ func TestJWTManager_GenerateAndVerifyToken(t *testing.T) {
 		// Verify token
 		verifiedClaims, err := jwtManager.ValidateToken(ctx, tokenResponse.RegistryToken)
 		require.NoError(t, err)
-		assert.Equal(t, model.AuthMethodGitHubAT, verifiedClaims.AuthMethod)
+		assert.Equal(t, auth.MethodGitHubAT, verifiedClaims.AuthMethod)
 		assert.Equal(t, "testuser", verifiedClaims.AuthMethodSubject)
 		assert.Equal(t, "mcp-registry", verifiedClaims.Issuer)
 		assert.Len(t, verifiedClaims.Permissions, 1)
@@ -70,7 +69,7 @@ func TestJWTManager_GenerateAndVerifyToken(t *testing.T) {
 				NotBefore: notBefore,
 				Issuer:    "custom-issuer",
 			},
-			AuthMethod:        model.AuthMethodNone,
+			AuthMethod:        auth.MethodNone,
 			AuthMethodSubject: "anonymous",
 			Permissions: []auth.Permission{
 				{
@@ -87,7 +86,7 @@ func TestJWTManager_GenerateAndVerifyToken(t *testing.T) {
 		// Verify token
 		verifiedClaims, err := jwtManager.ValidateToken(ctx, tokenResponse.RegistryToken)
 		require.NoError(t, err)
-		assert.Equal(t, model.AuthMethodNone, verifiedClaims.AuthMethod)
+		assert.Equal(t, auth.MethodNone, verifiedClaims.AuthMethod)
 		assert.Equal(t, "anonymous", verifiedClaims.AuthMethodSubject)
 		assert.Equal(t, "custom-issuer", verifiedClaims.Issuer)
 		assert.Equal(t, issuedAt.Unix(), verifiedClaims.IssuedAt.Unix())
@@ -100,7 +99,7 @@ func TestJWTManager_GenerateAndVerifyToken(t *testing.T) {
 			RegisteredClaims: jwt.RegisteredClaims{
 				ExpiresAt: jwt.NewNumericDate(time.Now().Add(-1 * time.Hour)), // Already expired
 			},
-			AuthMethod:        model.AuthMethodGitHubAT,
+			AuthMethod:        auth.MethodGitHubAT,
 			AuthMethodSubject: "testuser",
 		}
 
@@ -126,7 +125,7 @@ func TestJWTManager_GenerateAndVerifyToken(t *testing.T) {
 		differentJWTManager := auth.NewJWTManager(differentCfg)
 
 		claims := auth.JWTClaims{
-			AuthMethod:        model.AuthMethodGitHubAT,
+			AuthMethod:        auth.MethodGitHubAT,
 			AuthMethodSubject: "testuser",
 		}
 
@@ -149,7 +148,7 @@ func TestJWTManager_GenerateAndVerifyToken(t *testing.T) {
 
 	t.Run("multiple permissions", func(t *testing.T) {
 		claims := auth.JWTClaims{
-			AuthMethod:        model.AuthMethodGitHubAT,
+			AuthMethod:        auth.MethodGitHubAT,
 			AuthMethodSubject: "admin",
 			Permissions: []auth.Permission{
 				{
@@ -305,7 +304,7 @@ func TestJWTManager_BlockedNamespaces(t *testing.T) {
 		jwtManager := auth.NewJWTManager(cfg)
 		
 		claims := auth.JWTClaims{
-			AuthMethod:        model.AuthMethodGitHubAT,
+			AuthMethod:        auth.MethodGitHubAT,
 			AuthMethodSubject: "spammer",
 			Permissions: []auth.Permission{
 				{
@@ -330,7 +329,7 @@ func TestJWTManager_BlockedNamespaces(t *testing.T) {
 		jwtManager := auth.NewJWTManager(cfg)
 		
 		claims := auth.JWTClaims{
-			AuthMethod:        model.AuthMethodGitHubAT,
+			AuthMethod:        auth.MethodGitHubAT,
 			AuthMethodSubject: "gooduser",
 			Permissions: []auth.Permission{
 				{
@@ -354,7 +353,7 @@ func TestJWTManager_BlockedNamespaces(t *testing.T) {
 		jwtManager := auth.NewJWTManager(cfg)
 		
 		claims := auth.JWTClaims{
-			AuthMethod:        model.AuthMethodGitHubAT,
+			AuthMethod:        auth.MethodGitHubAT,
 			AuthMethodSubject: "user",
 			Permissions: []auth.Permission{
 				{
@@ -383,7 +382,7 @@ func TestJWTManager_BlockedNamespaces(t *testing.T) {
 		jwtManager := auth.NewJWTManager(cfg)
 		
 		claims := auth.JWTClaims{
-			AuthMethod:        model.AuthMethodNone,
+			AuthMethod:        auth.MethodNone,
 			AuthMethodSubject: "admin",
 			Permissions: []auth.Permission{
 				{

internal/auth/types.go

@@ -0,0 +1,19 @@
+package auth
+
+// Method represents the authentication method used
+type Method string
+
+const (
+	// GitHub OAuth authentication (access token)
+	MethodGitHubAT Method = "github-at"
+	// GitHub Actions OIDC authentication
+	MethodGitHubOIDC Method = "github-oidc"
+	// Generic OIDC authentication
+	MethodOIDC Method = "oidc"
+	// DNS-based public/private key authentication
+	MethodDNS Method = "dns"
+	// HTTP-based public/private key authentication
+	MethodHTTP Method = "http"
+	// No authentication - should only be used for local development and testing
+	MethodNone Method = "none"
+)