Authenticate admin forms with the MCP Bearer of a registered user (Authorization header or bearer field).
Known user in this request: no
Yandex implicit token: after authorize, fragment contains access_token. POST it to /oauth/yandex/store with state.