docs: document oauth auth login

docs/wf_cli.md

@@ -407,6 +407,51 @@ wf admin auth delete drive.work --confirm
 Use source `auth_ref` values to point sources at these records. Do not commit
 payload files containing real secrets.
 
+### Google Drive MCP OAuth Setup
+
+Google Drive MCP is a remote HTTP MCP source:
+
+```json
+{
+  "sources": [
+    {
+      "id": "google.drive",
+      "kind": "mcp",
+      "transport": {
+        "kind": "http",
+        "url": "https://drivemcp.googleapis.com/mcp/v1"
+      },
+      "auth_ref": "google.drive.personal"
+    }
+  ],
+  "auth": {
+    "providers": {
+      "google": {
+        "kind": "oauth_authorization_code_pkce",
+        "auth_url": "https://accounts.google.com/o/oauth2/v2/auth",
+        "token_url": "https://oauth2.googleapis.com/token",
+        "client_id_env": "GOOGLE_OAUTH_CLIENT_ID",
+        "client_secret_env": "GOOGLE_OAUTH_CLIENT_SECRET",
+        "scopes": [
+          "https://www.googleapis.com/auth/drive.readonly"
+        ]
+      }
+    }
+  }
+}
+```
+
+Run OAuth login:
+
+```bash
+wf --config wf.config.json admin auth oauth-login google \
+  --id google.drive.personal \
+  --authorization-response "<redirected URL>"
+```
+
+Refresh tokens are sensitive. The local file auth store is plaintext and
+intended for local/dev use only.
+
 ### `source_missing`
 
 A required logical source is not available or not bound.