Fix OCI route mounting — integrate into authenticated /v2 group

NewRouter now accepts an optional OCI handler to mount inside the
authenticated /v2 route group, avoiding chi's Mount conflict on
an existing path.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

cmd/mcrsrv/main.go

@@ -123,9 +123,7 @@ func runServer(configPath string) error {
 	// Create OCI handler and HTTP router.
 	ociHandler := oci.NewHandler(database, store, policyEngine, auditFn)
 
-	router := server.NewRouter(authClient, authClient, cfg.MCIAS.ServiceName)
-	// Mount OCI endpoints at /v2.
-	router.Mount("/v2", ociHandler.Router())
+	router := server.NewRouter(authClient, authClient, cfg.MCIAS.ServiceName, ociHandler.Router())
 	// Mount admin REST endpoints.
 	gcState := &server.GCState{
 		Collector: collector,