Gateway missing MCP OAuth spec endpoints (RFC 8414, RFC 7591) - blocks Claude Desktop/claude.ai connector integration

## Description

The AgentCore MCP Gateway does not implement the OAuth endpoints required by the [MCP Authorization Specification](https://modelcontextprotocol.io/specification/2025-03-26/basic/authorization). This prevents MCP clients like Claude Desktop and claude.ai from connecting without manually providing OAuth client credentials.

## What's Missing

### 1. OAuth Authorization Server Metadata (RFC 8414)

```bash
curl https://{gateway}.gateway.bedrock-agentcore.us-east-1.amazonaws.com/.well-known/oauth-authorization-server
# Returns:
```

The MCP spec requires servers to expose `/.well-known/oauth-authorization-server` so clients can discover the authorization and token endpoints. The Gateway only exposes `/.well-known/oauth-protected-resource` (RFC 9728), which correctly points to Cognito, but Cognito itself doesn't serve RFC 8414 metadata (only OIDC discovery).

### 2. Dynamic Client Registration (RFC 7591)

```bash
curl -X POST https://{gateway}.gateway.bedrock-agentcore.us-east-1.amazonaws.com/register \
-H "Content-Type: application/json" \
-d '{"client_name":"claude-desktop","redirect_uris":["https://claude.ai/api/mcp/auth_callback"]}'
# Returns: {"Output":{"__type":"com.amazon.coral.service#UnknownOperationException"}}
```

The MCP spec requires servers to support Dynamic Client Registration so MCP clients can automatically obtain OAuth credentials. Without this, users must manually configure client_id and client_secret when adding the connector.

## Impact

Claude Desktop and claude.ai support MCP OAuth (both 3/26 and 6/18 specs) with Dynamic Client Registration. The expected user experience is:

1. User pastes Gateway MCP URL into Claude Settings > Connectors
2. Claude auto-discovers OAuth config and registers itself
3. User authenticates via federated IdP (e.g., Google Workspace)
4. Done

**Current experience:** Users must manually obtain and enter Cognito client_id and client_secret in Claude's "Advanced settings." This defeats the purpose of a managed gateway and makes it impractical for non-technical users.

## What the Gateway Should Do

The Gateway should proxy the OAuth discovery and registration endpoints to/from the configured Cognito user pool:

1. **`/.well-known/oauth-authorization-server`** - Return RFC 8414 metadata derived from Cognito's OIDC discovery, including a `registration_endpoint`
2. **`/register`** (POST) - Accept RFC 7591 registration requests, create a Cognito app client with the provided redirect URIs, and return the client credentials

This would make any AgentCore Gateway instantly compatible with Claude and other MCP clients that implement the spec.

## Environment
- Region: us-east-1
- Gateway auth: CUSTOM_JWT with Cognito user pool
- Cognito IdP: Google (Workspace federation)
- MCP client: Claude Desktop / claude.ai

## Related
- #1030 (Gateway → Runtime JWT auth bug)

Start by examining the Gateway's existing /.well-known/oauth-protected-resource behavior and Cognito's OIDC discovery response, then reproduce the documented curl requests for /.well-known/oauth-authorization-server and /register. Done means returning RFC 8414 metadata and handling RFC 7591 registration with Cognito app-client credentials and redirect URIs.

Written by the indexing model from the issue text.