Claude.ai web: DCR-enabled Clerk connector fails "Couldn't register" — scope-less registration → openid mismatch (web sibling of claude-code#67714)

### MCP server URL or name

A self-hosted remote MCP server (Streamable HTTP) whose OAuth **authorization server is a Clerk instance** (Frontend API `*.clerk.accounts.dev`). URL withheld, but reproducible with any Clerk-fronted MCP server that has Dynamic Client Registration enabled.

### How are you connecting to this server?

Adding it as a **custom connector by URL** (Claude.ai web).

### Where does the issue occur?

When pressing **Connect** — at the OAuth dynamic client registration / authorization step.

### When did you last reproduce this?

2026-06-27, Claude.ai web, macOS (Chrome).

### Describe the issue

Connecting a custom connector whose OAuth AS is **Clerk** fails at connect with **"Couldn't register with 's sign-in service."**

This is **not** the "DCR-not-enabled" case (#164) and **not** a server-side rejection (#386 / #489). Verified:

- **DCR is enabled** on the Clerk instance — `/.well-known/oauth-authorization-server` advertises `registration_endpoint`.
- The RS metadata `/.well-known/oauth-protected-resource/mcp` returns **200** and points `authorization_servers` at the Clerk instance; unauthenticated `POST /mcp` returns **401** with a correct `WWW-Authenticate … resource_metadata=…`.
- The DCR call to Clerk **succeeds** — a client *is* created (visible as `oauth_application.created` in Clerk logs; a manual `POST /oauth/register` returns **201**).
- A **manually pre-registered public client** (PKCE, Client ID only, no secret) **connects fine and lists tools**. So the only broken path is the **automatic DCR**.

This looks like the **web surface of anthropics/claude-code#67714**: Claude performs DCR **without a `scope` field**, so Clerk registers the client with its default scopes `email offline_access profile` (**no `openid`**). Claude then requests authorization with `scope=openid …` (derived from the AS `scopes_supported`, which includes `openid`), and Clerk rejects with `invalid_scope: The OAuth 2.0 Client is not allowed to request scope 'openid'`. The registration↔authorization scope sets diverge.

### Error details

Pop-up shown on Connect:

> Couldn't register with 's sign-in service. You can try again, or add an OAuth Client ID in the connector settings.

Flow references (please pull the broker traces):
`ofid_d5cb51a03d2ed028`, `ofid_6f05dd3ba299559d`, `ofid_2b26dea1f807a495`

Representative Clerk DCR response (secret redacted) — note the scope-less default omits `openid`, `client_id_issued_at` is in **milliseconds** (RFC 7591 wants seconds), and `grant_types` omits `refresh_token` despite `offline_access`:

```json
{
"client_id": "",
"client_id_issued_at": 1782556508066,
"grant_types": ["authorization_code"],
"scope": "email offline_access profile",
"token_endpoint_auth_method": "none"
}
```

### Expected behavior

- Register and authorize with a **consistent scope set** — don't request `openid`/scopes the freshly DCR-registered client wasn't granted (as tracked for the CLI in #67714).
- When the AS returns an error, **surface the underlying AS error** instead of a generic "Couldn't register" — registration actually succeeded; the failure is at the authorize step.

### Workaround that works

Providing a manually pre-registered **public** OAuth Client ID (no secret, PKCE) in the connector's advanced settings connects and lists tools.

### Related

- anthropics/claude-code#67714 — same root cause, **CLI** surface (scope-less DCR registration reuse → `openid` mismatch).
- #164 — related (Clerk DCR) but a **different cause**: that was DCR not enabled; here DCR is enabled and registration succeeds.

_(Filed with Claude Code.)_