Conformance audit: MCP authorization spec 2026-07-28 (docs pin 2025-06-18 — two revisions stale)

Audit the MCP OAuth surface against the current MCP specification revision (2026-07-28) — docs/mcp-oauth.md currently pins 2025-06-18, two revisions stale. #200 handles the CIMD grant-type validation piece; this issue covers the rest of the surface:

- **RFC 9207 issuer identification**: emit `iss` in authorization responses (including error responses) and advertise `authorization_response_iss_parameter_supported: true` in AS metadata. The July revision flags the SHOULD as upgrading to MUST in a future revision.
- **RFC 8707 resource indicators / audience binding**: clients MUST send `resource` on both authorization and token requests regardless of AS support — verify we accept it, bind token audience to the canonical resource URI, and (RS side) validate audience per RFC 8707 §2.
- **RFC 9728 Protected Resource Metadata**: RS MUST serve it and clients discover the AS through it — verify our resource-server integration surfaces it correctly, including `WWW-Authenticate` with `resource_metadata` on 401.
- **Scope challenge shape**: 403 + `error="insufficient_scope"` + `scope` + `resource_metadata` in `WWW-Authenticate` per RFC 6750 §3.1, single-challenge completeness, scope-hierarchy accounting.
- **CIMD security considerations**: the July spec's Client ID Metadata Document security section (SSRF posture on metadata fetch, cache behavior per HTTP headers, redirect_uri validation strictness) — verify against draft-ietf-oauth-client-id-metadata-document-00 §6.
- **DCR deprecation posture**: DCR is formally deprecated in 2026-07-28 (backwards compat only) — document ours as legacy-compat and consider a deprecation note in the module docs.

Deliverable: conformance matrix (requirement → status → gap), fixes filed as scoped follow-ups. Update docs/mcp-oauth.md to state the audited revision when complete (interim pointer bump lands with #200).

Start with docs/mcp-oauth.md and the current MCP OAuth implementation, then build the requested conformance matrix requirement by requirement. Check the RFC 9207, RFC 8707, RFC 9728, RFC 6750, CIMD, and DCR items listed in the issue, accounting for the scope already covered by #200. Done means the matrix records status and gaps, scoped follow-ups are filed, and docs/mcp-oauth.md names the audited revision.

Written by the indexing model from the issue text.