01-tutorials - [Bug]

**In which component is this bug present?**

- [X] 01-AgentCore-runtime
- [ ] 02-AgentCore-gateway
- [ ] 03-AgentCore-identity
- [ ] 04-AgentCore-memory
- [ ] 05-AgentCore-tools
- [ ] 06-AgentCore-observability
- [ ] 07-AgentCore-E2E

**Bug Description**

The MCP server authentication tutorial uses an inappropriate authentication flow for service-to-service communication.

**Current Implementation**

In the [hosting_mcp_server.ipynb](https://github.com/awslabs/amazon-bedrock-agentcore-samples/blob/main/01-tutorials/01-AgentCore-runtime/02-hosting-MCP-server/hosting_mcp_server.ipynb) tutorial, the `setup_cognito_user_pool()` function ([source](https://github.com/awslabs/amazon-bedrock-agentcore-samples/blob/235e9cb514d387076988d8b7dfda88e4f50c62bb/01-tutorials/utils.py#L7)) creates a Cognito User Pool with:

- Username/password authentication flow (`ALLOW_USER_PASSWORD_AUTH`)
- A test user (`testuser`) with hardcoded credentials
- User-based bearer token for MCP server authentication

**Issue**

Using username/password authentication for securing remote MCP servers is not following OAuth 2.0 best practices for service-to-service communication.

**Expected Behavior**

For MCP server authentication, the tutorial should implement OAuth 2.0 Client Credentials flow instead:

- **Service-to-Service**: MCP servers are backend services, not user applications
- **Security**: No user credentials to manage or expose
- **Scalability**: Better suited for automated/containerized environments
- **Standards Compliance**: Follows OAuth 2.0 best practices for machine-to-machine authentication

**Suggested Solution**

Replace the current App Client configuration:
```python
# Current (problematic)
ExplicitAuthFlows=[
'ALLOW_USER_PASSWORD_AUTH',
'ALLOW_REFRESH_TOKEN_AUTH'
]

With Client Credentials flow:

# Recommended
ExplicitAuthFlows=['ALLOW_CLIENT_CREDENTIALS'],
AllowedOAuthFlows=['client_credentials'],
AllowedOAuthScopes=['custom/mcp-server'],
GenerateSecret=True

```

This might eliminate the need for test user creation and provide more appropriate authentication for the MCP server use case.