Custom connector: OAuth completes (token issued) but MCP request sent with no Authorization header; auto-DCR shows "couldn't register" despite 201

### MCP server URL

https://lionreader.com/api/mcp

### Where does the issue occur?

When pressing the Connect button

### Transport used

streamable-http

### Client registration type

Dynamic Client Registration (DCR)

### SSE only: Does your server return the expected status code for POST requests?

Not applicable (my server does not use SSE)

### When did you last reproduce this?

2026-07-04, 20:19 UTC

### Browser and OS

Firefox Mobile on Android and Firefox 152.0.4 on Ubuntu

### Describe the issue

Remote MCP server: `https://lionreader.com/api/mcp` (streamable HTTP, own OAuth 2.1 AS). The claude.ai **web** custom connector fails; the same server connects fine via **Claude Code**, **Claude Desktop**, and **`npx mcp-remote`**. We've verified the full OAuth flow server-side and believe both failures are on the connector client. Two distinct `ofid`s, both recent:

### 1. `ofid_39ffc11637040579` — manual client (ID + secret): token issued, then MCP request has no Authorization header
Advanced-settings OAuth Client ID + Secret (confidential, `client_secret_post`). Server logs for this attempt:
- `GET /authorize` (PKCE S256, `redirect_uri=https://claude.ai/api/mcp/auth_callback`) → 303 to callback with `code`
- `POST /token` (`grant_type=authorization_code`, code + verifier + secret) → **`200` with a valid Bearer** (`token_type=Bearer`, `expires_in=3600`, `scope=mcp`, issued for `resource=https://lionreader.com/api/mcp`). ~18ms.
- claude.ai then sends `POST /api/mcp` (initialize) with **no `Authorization` header** → we return `401` → "authorization failed".

The access token is issued and never presented. (Looks like #136 / #162 / #325.)

### 2. `ofid_69d617184716ec22` — auto (DCR): "couldn't register" despite our `/register` returning 201
No manual client. Server logs:
- Discovery OK: `401` + `WWW-Authenticate: Bearer resource_metadata="…/.well-known/oauth-protected-resource/api/mcp"`, then PRM (path-inserted + root) and `oauth-authorization-server` metadata all `200`.
- `POST /register` (RFC 7591 DCR) → our handler returns **`201` with a valid `client_id`** (confirmed by direct `curl` too).
- claude.ai shows **"Couldn't register with … sign-in service"** and never issues an `/authorize` request.

### Notes for triage
- RFC 8414 metadata with `registration_endpoint`, `code_challenge_methods_supported: ["S256"]`, `token_endpoint_auth_methods_supported: ["none"]`; RFC 9728 protected-resource metadata at both path-inserted and root locations; `resource` = canonical `https://lionreader.com/api/mcp`.
- Because claude.ai synthesizes OAuth endpoints at the **origin root** and ignores our advertised `/oauth/*` paths (per #82/#341), we alias `/authorize`, `/token`, and `POST /register` at the root — which is why the manual flow reaches token issuance at all.
- Reproduced the manual failure identically with a **public** (PKCE) client and a **confidential** client — both issue tokens, both dropped.
- MCP endpoint is at a **subpath** (`/api/mcp`) rather than a dedicated subdomain (cf. #367, #490).

### Issue details

```shell
With auto-config, hitting "Connect" immediately causes a popup that shows:

> Couldn't register with Lion Reader's sign-in service. You can try again, or add an OAuth Client ID in the connector settings. If this persists, share this reference with support: "ofid_69d617184716ec22"

With manual config, I get to the Lion Reader auth page but after approving, it redirects back and I get a popup with:

> Authorization with the MCP server failed. You can check your credentials and permissions. If this persists, share this reference with support: "ofid_39ffc11637040579"
```

### Expected behavior

MCP auth succeeds with both auto and manual config.

### Logs from your server

```shell
With manual config:

20:17:35 {"timestamp":"2026-07-04T20:17:35.005Z","level":"warn","message":"MCP auth unauthorized","context":{"reason":"no_authorization_header"},"service":"lion-reader","reason":"no_authorization_header"}
20:17:35 {"timestamp":"2026-07-04T20:17:35.183Z","level":"info","message":"OAuth protected resource metadata requested (path-inserted)","service":"lion-reader"}
20:17:35 {"timestamp":"2026-07-04T20:17:35.422Z","level":"info","message":"OAuth protected resource metadata requested","service":"lion-reader"}
20:17:35 {"timestamp":"2026-07-04T20:17:35.573Z","level":"info","message":"OAuth authorization server metadata requested","service":"lion-reader"}
20:17:35 {"timestamp":"2026-07-04T20:17:35.969Z","level":"info","message":"OAuth authorize GET","context":{"url":"/authorize?response_type=code&client_id=019f2ec6-e4ec-74b1-a874-55c706a1c6e5&redirect_uri=https%3A%2F%2Fclaude.ai%2Fapi%2Fmcp%2Fauth_callback&code_challenge=pHIbS3vJp8F8ns3vhdb_v-wEt3Hac1krQp1kdCIDCno&code_challenge_method=S256&state=77HzwWm7oq9HnAfE9LbhHp6r3uZ5uCghKlEhSwfDB_Y"},"service":"lion-reader","url":"/authorize?response_type=code&client_id=019f2ec6-e4ec-74b1-a874-55c706a1c6e5&redirect_uri=https%3A%2F%2Fclaude.ai%2Fapi%2Fmcp%2Fauth_callback&code_challenge=pHIbS3vJp8F8ns3vhdb_v-wEt3Hac1krQp1kdCIDCno&code_challenge_method=S256&state=77HzwWm7oq9HnAfE9LbhHp6r3uZ5uCghKlEhSwfDB_Y"}
20:17:38 {"timestamp":"2026-07-04T20:17:38.053Z","level":"info","message":"OAuth token request","context":{"grantType":"authorization_code","clientId":"019f2ec6-e4ec-74b1-a874-55c706a1c6e5","hasCode":true,"hasCodeVerifier":true,"hasRedirectUri":true,"hasRefreshToken":false},"service":"lion-reader","grantType":"authorization_code","clientId":"019f2ec6-e4ec-74b1-a874-55c706a1c6e5","hasCode":true,"hasCodeVerifier":true,"hasRedirectUri":true,"hasRefreshToken":false}
20:17:38 {"timestamp":"2026-07-04T20:17:38.076Z","level":"info","message":"OAuth token issued","context":{"grantType":"authorization_code","clientId":"019f2ec6-e4ec-74b1-a874-55c706a1c6e5","userId":"019b621d-6cba-7333-a7fc-8a6aa05b2cc1","scope":"mcp","resource":"https://lionreader.com/api/mcp"},"service":"lion-reader","grantType":"authorization_code","clientId":"019f2ec6-e4ec-74b1-a874-55c706a1c6e5","userId":"019b621d-6cba-7333-a7fc-8a6aa05b2cc1","scope":"mcp","resource":"https://lionreader.com/api/mcp"}
20:17:39 {"timestamp":"2026-07-04T20:17:39.809Z","level":"warn","message":"MCP auth unauthorized","context":{"reason":"no_authorization_header"},"service":"lion-reader","reason":"no_authorization_header"}

With auto-config:

20:19:03 {"timestamp":"2026-07-04T20:19:03.416Z","level":"warn","message":"MCP auth unauthorized","context":{"reason":"no_authorization_header"},"service":"lion-reader","reason":"no_authorization_header"}
20:19:03 {"timestamp":"2026-07-04T20:19:03.580Z","level":"info","message":"OAuth protected resource metadata requested (path-inserted)","service":"lion-reader"}
20:19:03 {"timestamp":"2026-07-04T20:19:03.798Z","level":"info","message":"OAuth protected resource metadata requested","service":"lion-reader"}
20:19:03 {"timestamp":"2026-07-04T20:19:03.929Z","level":"info","message":"OAuth authorization server metadata requested","service":"lion-reader"}
20:19:04 {"timestamp":"2026-07-04T20:19:04.118Z","level":"info","message":"OAuth client registration requested","service":"lion-reader"}
20:19:05 {"timestamp":"2026-07-04T20:19:05.952Z","level":"warn","message":"MCP auth unauthorized","context":{"reason":"no_authorization_header"},"service":"lion-reader","reason":"no_authorization_header"}
```

### Additional context

_No response_