OAuth Full Access grant returns error 10000 for Rulesets GET endpoints

> Filed by GPT-5.6 Sol on behalf of Reuben.

### MCP Client

Other: GitHub Copilot desktop app 1.0.79-9

### Authentication Type

OAuth

### OAuth Scopes

Full Access selected during authorization; Zone WAF Read was visibly enabled.

### MCP Server Configuration

```json
{
"mcpServers": {
"cloudflare-api": {
"type": "http",
"url": "https://mcp.cloudflare.com/mcp"
}
}
}
```

### Failing Endpoint / Tool

`execute` calling Rulesets endpoints, including:

- `GET /zones/{zone_id}/rulesets`
- `GET /zones/{zone_id}/rulesets/phases/http_request_firewall_custom/entrypoint`
- `GET /zones/{zone_id}/rulesets/phases/http_request_firewall_managed/entrypoint`
- `GET /accounts/{account_id}/rulesets`

### Bug Description

A freshly authorized Full Access OAuth grant can successfully read identity, zone details, analytics, and zone settings, but all tested modern Rulesets GET endpoints fail with Cloudflare API error `10000: Authentication error`. Zone details report both `#waf:read` and `#waf:edit`, and the user is a Super Administrator.

This resembles #178, but affects read requests after the reported fix.

### Steps to Reproduce

1. Configure `https://mcp.cloudflare.com/mcp` in GitHub Copilot desktop.
2. Authorize using OAuth and select Full Access, including Zone WAF Read.
3. Call `GET /zones/{zone_id}` through `execute`; it succeeds and reports WAF read/edit permissions.
4. Call `GET /zones/{zone_id}/settings/security_level`; it succeeds.
5. Call `GET /zones/{zone_id}/rulesets`; it fails with error 10000.
6. Call custom/managed Rulesets phase entrypoints or account Rulesets; they fail identically.
7. Revoke the upstream authorization under Cloudflare Connected Applications, remove the MCP connection, reconnect, and authorize Full Access again. The failures persist.

### Expected Behavior

Rulesets GET requests should succeed with a fresh OAuth grant containing Zone WAF Read (and Full Access).

### Actual Behavior

Every tested Rulesets GET returns:

```text
MCP server 'cloudflare': Error: Cloudflare API error: 10000: Authentication error
```

### Additional Context

- The same OAuth connection successfully calls `/user`, `/zones/{zone_id}`, GraphQL Analytics, and zone settings endpoints.
- Legacy WAF endpoint `/zones/{zone_id}/firewall/waf/overrides` reaches the API and returns error 1040 stating legacy WAF is deprecated and Managed Rulesets should be used.
- `/user/tokens/verify` returns Invalid API Token, as expected for an OAuth bearer rather than an API token.
- No account IDs, zone IDs, tokens, or authorization URLs are included here.

Reproduce the OAuth flow through the MCP server's `execute` entry point, comparing successful `/user`, `/zones/{zone_id}`, and settings calls with the failing Rulesets GET endpoints. Trace the authorization handling for those requests and verify that a fresh Full Access grant with Zone WAF Read allows all listed Rulesets calls without error 10000.

Written by the indexing model from the issue text.