An environment can now sign in to another one's /mcp as an outside agent,
with a pairing code from that environment, without a browser. It drives the
peer's existing MCP OAuth flow server-side, keeps the token in the server
secret store and the rest in peer_environment_links (migration 059). The
peer lists the link as "T3 Code · <label>" in Connections, where it can be
revoked.

The token is only ever sent to an address whose descriptor answers as the
linked environment. PeerMcpClient calls the peer's tools and carries the
caller's limits in T3-Mode-Limit on every request. Linking refuses this
environment itself and peers that cannot honour that header.

`t3 environment link|list|unlink` and the peerLinks.* RPCs manage links.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>