OAuth completes, token issued, but post-auth handshake fails — ofid reference included

### MCP server URL

https://dell-test.uniqueimprovements.com.au/api/webhook/mcp_fa2f03661ad42623fee00072b88baf54

### Where does the issue occur?

When auth finishes and redirects back to Claude.ai

### Transport used

streamable-http

### Client registration type

Dynamic Client Registration (DCR)

### SSE only: Does your server return the expected status code for POST requests?

Not applicable (my server does not use SSE)

### When did you last reproduce this?

2026-08-26 6:04 PM AEST (2026-08-26 08:04 UTC)

### Browser and OS

Chrome 151.0.0.0 on Windows 11 Home

### Describe the issue

OAuth flow completes successfully — Home Assistant (running the ha_mcp_tools custom integration, v8.3.0) issues an authorization code, and my browser is redirected to https://claude.ai/api/mcp/auth_callback with a valid code and state. Within under 1 second, Claude's UI shows "Authorization with [connector] failed" / error_code=mcp_token_exchange_failed.

I confirmed via my Cloudflare dashboard (Security > Analytics > Events) that a POST to /api/ha_mcp_tools/oauth/token from Claude's backend (identifying as python-httpx/0.28.1) does reach my origin every time, with Mitigation: Not mitigated and Cache status: None — so it is not being blocked or challenged by any WAF/bot rule.

However, this exact request never appears in my Home Assistant server logs, even with debug logging enabled on custom_components.ha_mcp_tools, homeassistant.components.http, homeassistant.components.auth, and aiohttp.access, and live-tailed via `ha core logs -f` during multiple fresh attempts.

I've read issue #125 and believe this may match "Cause #4: Your server rejects our post-OAuth handshake" — i.e., the token exchange itself may succeed, but a subsequent MCP initialize/handshake request with the Authorization: Bearer header may be failing at my origin in a way that isn't visible in my own logs. I'd like to know what status code my server returned to that handshake request, if possible, using the reference ID below.

I also tested this integration's "Legacy OAuth" mode (static Client ID/Secret) and got the identical symptom — same instant failure after a successful authorize step.

ofid reference: ofid_293b02dff4da9a51
ofid_b20993c534cec794 (corresponds to attempt at 2026-08-26 22:40:11 AEST / 12:40:11 UTC)

### Issue details

```shell
Unlike #336, my server never logs this request at all (not even a 403) — I have aiohttp.access debug logging enabled and can see it catching every other request, including internal polling, with zero gaps. The specific POST /api/webhook/mcp_fa2f03661ad42623fee00072b88baf54 request from Claude-User never appears, despite Cloudflare's Security Analytics confirming it left the edge as "Not mitigated" toward my origin at [timestamp]. This suggests the break may be between Cloudflare and my application layer specifically for this request, rather than a 403 my own server is generating.
```

### Expected behavior

The token exchange (and any subsequent handshake request) should either succeed, or Claude should surface the actual failure reason/status code so I can diagnose it on my end, rather than a generic "token exchange failed" with no visibility into what my server actually returned.

### Logs from your server

```shell
No relevant log entries were captured server-side despite full debug logging — see description above. Happy to provide a HAR export of the browser-side flow if useful.
```

### Additional context

MCP server URL: https://dell-test.uniqueimprovements.com.au/api/webhook/mcp_fa2f03661ad42623fee00072b88baf54
Related: #125

Server setup: Home Assistant OS 18.2, Core 2026.8.3, accessed via Cloudflare Tunnel (cloudflared). ha_mcp_tools runs its OAuth handling via an embedded server on 127.0.0.1:9584, separate from HA Core's main process — this may explain the lack of server-side log visibility if that embedded server doesn't log HTTP access itself.