Move OAuth config to Space vars and secret

Dockerfile

@@ -9,11 +9,6 @@ RUN apt-get update && \
 
 COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv
 
-ENV FAST_AGENT_SERVE_OAUTH=hf \
-    FAST_AGENT_OAUTH_SCOPES=inference-api \
-    FAST_AGENT_OAUTH_RESOURCE_URL=https://evalstate-hf-hub-query.hf.space \
-    HF_TOKEN=hf_dummy
-
 WORKDIR /app
 
 COPY wheels /tmp/wheels

README.md

@@ -20,6 +20,15 @@ This Space is configured for Hugging Face OAuth/token passthrough:
 - `FAST_AGENT_OAUTH_SCOPES=inference-api`
 - `--instance-scope request`
 
+These are configured as Space settings:
+
+- Variables:
+  - `FAST_AGENT_SERVE_OAUTH`
+  - `FAST_AGENT_OAUTH_SCOPES`
+  - `FAST_AGENT_OAUTH_RESOURCE_URL`
+- Secret:
+  - `HF_TOKEN` (dummy startup token)
+
 Clients can either:
 - send `Authorization: Bearer <HF_TOKEN>` directly, or
 - use MCP OAuth discovery/auth flow