Phase 10: mcat migrated to mcdsl

- Document mcat migration in PROGRESS.md
- Removed: internal/auth, internal/config, webserver/csrf.go
- Replaced by: mcdsl/auth, mcdsl/config, mcdsl/csrf, mcdsl/web
- mcias client library no longer a direct dependency
- mcat builds clean with vet + lint 0 issues

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

PROGRESS.md

@@ -73,5 +73,32 @@ Ready for first-adopter migration (Phase 10).
 
 ## Next Steps
 
-- Phase 10: First-adopter migration (mcat)
+### Phase 10: First Adopter — mcat (2026-03-25)
+
+mcat migrated to use mcdsl. The following internal packages were removed
+and replaced:
+
+| Removed | Replaced by |
+|---------|-------------|
+| `internal/auth/` (auth.go, auth_test.go) | `mcdsl/auth` |
+| `internal/config/` (config.go, config_test.go) | `mcdsl/config` |
+| `internal/webserver/csrf.go` | `mcdsl/csrf` |
+
+Remaining mcat-specific code:
+- `cmd/mcat/` — CLI wiring, mcatConfig type (embeds config.Base)
+- `internal/webserver/server.go` — routes, handlers (using mcdsl/auth,
+  mcdsl/csrf, mcdsl/web, mcdsl/httpserver)
+- `web/` — templates and static assets (unchanged)
+
+Dependencies removed:
+- `git.wntrmute.dev/kyle/mcias/clients/go` (mcdsl/auth handles MCIAS directly)
+- `github.com/pelletier/go-toml/v2` (now indirect via mcdsl/config)
+
+Dependencies added:
+- `git.wntrmute.dev/kyle/mcdsl` (local replace directive)
+
+Result: vet clean, lint 0 issues, builds successfully.
+
+## Next Steps
+
 - Phase 11: Broader adoption (metacrypt, mcr, mc-proxy, mcias)