OAuth authorization URL is incorrect when using Keycloak with pre-registered OAuth client

# OAuth authorization endpoint is incorrect with Keycloak pre-registered OAuth client

**Describe the bug**

I'm testing the pre-registered OAuth client support for `streamable_http` extensions introduced in Goose v1.47.0.

Reference:

* PR #11182: https://github.com/aaif-goose/goose/pull/11182
* Commit: `ea6dbf30b8e53ac5a623320eab1b77f61b604166`

My MCP Server uses Keycloak as the OAuth Authorization Server.

The setup is:

```text
MCP Resource Server:
http://:8789/mcp

Keycloak Issuer:
http://:18080/realms/hadoop-platform-mcp
```

The MCP Server is configured with Keycloak authentication:

```yaml
resource_server_url: "http://:8789/mcp"
issuer: "http://:18080/realms/hadoop-platform-mcp"
client_id: "mcp-server"
jwks_uri: "http://:18080/realms/hadoop-platform-mcp/protocol/openid-connect/certs"
```

The Goose extension is configured as:

```yaml
allen-oauth:
type: streamable_http
enabled: true
name: allen-oauth
uri: http://:8789/mcp
client_id: mcp-server
client_secret_key: AUTH_SECRET
scopes:
- mcp:tools
envs:
AUTH_SECRET:
```

When Goose starts the OAuth flow, the browser is redirected to:

```text
http://:8789/authorize?response_type=code&client_id=mcp-server&state=...&code_challenge=...&code_challenge_method=S256&redirect_uri=http%3A%2F%2F127.0.0.1%3A19920%2Foauth_callback&scope=mcp%3Atools&resource=http%3A%2F%2F%3A8789%2Fmcp
```

However, `/authorize` is not the Keycloak authorization endpoint in this setup.

The actual Keycloak authorization endpoint is:

```text
http://:18080/realms/hadoop-platform-mcp/protocol/openid-connect/auth
```

As a result, the browser is redirected to an endpoint that does not exist for the OAuth Authorization Server.

---

**To Reproduce**

Steps to reproduce the behavior:

1. Run an MCP Streamable HTTP server protected by Keycloak.

2. Configure Keycloak as the OAuth Authorization Server.

3. Register an OAuth client in Keycloak with:

```text
client_id: mcp-server
```

4. Configure Goose v1.47.0 with a pre-registered OAuth client:

```yaml
type: streamable_http
uri: http://:8789/mcp
client_id: mcp-server
client_secret_key: AUTH_SECRET
scopes:
- mcp:tools
```

5. Start Goose and trigger the OAuth authentication flow.

6. Goose opens:

```text
http://:8789/authorize
```

7. The OAuth authentication cannot proceed because this is not the Keycloak authorization endpoint.

---

**Expected behavior**

I expected Goose to use the authorization endpoint of the OAuth Authorization Server associated with the MCP Resource Server.

For this setup, the expected authorization endpoint is:

```text
http://:18080/realms/hadoop-platform-mcp/protocol/openid-connect/auth
```

The resulting URL should therefore look similar to:

```text
http://:18080/realms/hadoop-platform-mcp/protocol/openid-connect/auth?response_type=code&client_id=mcp-server&code_challenge=...&code_challenge_method=S256&redirect_uri=http%3A%2F%2F127.0.0.1%3A19920%2Foauth_callback&state=...&scope=mcp%3Atools&resource=http%3A%2F%2F%3A8789%2Fmcp
```

The same MCP Server works correctly with MCP Inspector.

MCP Inspector redirects to the Keycloak authorization endpoint:

```text
http://:18080/realms/hadoop-platform-mcp/protocol/openid-connect/auth?response_type=code&client_id=mcp-server&code_challenge=...&code_challenge_method=S256&redirect_uri=http%3A%2F%2Flocalhost%3A6274%2Foauth%2Fcallback&state=...&scope=mcp%3Atools&resource=http%3A%2F%2F%3A8789%2Fmcp
```

I can successfully log in through Keycloak and complete the OAuth authentication using MCP Inspector.

---

**Screenshots**

If applicable, I can provide screenshots showing:

* Goose OAuth redirect
* Keycloak login page
* Successful MCP Inspector OAuth flow

---

**Please provide the following information**

* **OS & Arch:** Rocky Linux 8 x86_64
* **Interface:** Desktop / CLI
* **Version:** v1.47.0
* **Extensions enabled:** `streamable_http` with pre-registered OAuth client
* **Provider & Model:** glm-5
* **OAuth Provider:** Keycloak
* **MCP Transport:** Streamable HTTP

---

**Additional context**

The MCP Server and Keycloak OAuth configuration appear to be working correctly because the same MCP Server can authenticate successfully through MCP Inspector.

The main difference is the authorization URL generated by the client.

Goose generates:

```text
http://:8789/authorize
```

while MCP Inspector uses:

```text
http://:18080/realms/hadoop-platform-mcp/protocol/openid-connect/auth
```

This makes me suspect that Goose may be using the MCP Resource Server origin to construct the OAuth authorization endpoint instead of resolving the actual Authorization Server and its `authorization_endpoint`.

Could you please verify whether the OAuth Authorization Server / authorization endpoint is being resolved correctly for pre-registered OAuth clients?

I can provide additional diagnostics or logs if needed.

Do not begin implementation until the issue reaches **Ready** on the Goose Issues board.

Look at the OAuth client handling in the streamable_http extension, likely in the authentication module. The bug is that the authorization endpoint is incorrectly derived from the MCP server URI instead of the OAuth issuer's discovery endpoint. Start by finding where the OAuth flow constructs the authorization URL for pre-registered clients. Check how the issuer URL is resolved to the authorization_endpoint via OpenID Connect discovery. Run the existing OAuth tests to understand the expected behavior.

Scritto dal modello di indicizzazione a partire dal testo della issue.