docs: replace the oauth2 experiment with CODER_OAUTH2_PROVIDER_ENABLE - #29268

• docs/admin/integrations/oauth2-provider.md: the title and callout drop "experimental". The Enable section shows the CLI flag, env var, YAML key and Helm coder.env forms. The troubleshooting entry becomes "OAuth2 endpoints return 404". The limitations and feedback sections drop the experimental framing.
• docs/ai-coder/mcp-server.md: prerequisites become the flag plus CODER_EXPERIMENTS=mcp-server-http. The OAuth2 note and troubleshooting bullet name the flag.
• docs/install/releases/feature-stages.md: one sentence in the GA section says a few GA features are off by default, naming the provider.

OAuth 2.1 provider is generally available and off by default. Set CODER_OAUTH2_PROVIDER_ENABLE=true to turn it on. The oauth2 experiment no longer has any effect and will be removed in a future release. Deployments that relied on CODER_EXPERIMENTS=oauth2 must set the new flag or their OAuth2 clients get 404 responses after upgrading. Setting the environment variable before upgrading is safe and avoids the gap; the old binary ignores it. Do not set the YAML key or the CLI flag before upgrading, because the old binary rejects both. On Kubernetes, set it through coder.env rather than coder.commandArgs, so pods on the old image keep starting. Existing OAuth2 applications, secrets and user authorizations are preserved and resume when the flag is set. Access tokens issued before the upgrade remain valid until they expire.