[Bugs] Title: Copilot MCP OAuth uses wrong client/resource for remote Dataverse MCP ...

**Mood:** 😔
**Category:** Bugs

Title: Copilot MCP OAuth uses wrong client/resource for remote Dataverse MCP server → AADSTS65002 on (re)auth & refresh

Summary:
When connecting to or refreshing a remote Dataverse MCP server (https://.crm.dynamics.com/api/mcp, Entra/Azure AD auth), the app's interactive auth requests a token as client 04b07795-8ddb-461a-bbee-02f9e1bf7b46 (Azure CLI) for resource 00000007-0000-0000-c000-000000000000 (generic Dataverse Web API). Entra rejects this first-party→first-party combination with AADSTS65002 ("Consent … must be configured via preauthorization"). The auth popup therefore always fails and recurs.

Expected behavior:
The client should honor the server's published protected-resource metadata. GET https://.crm.dynamics.com/.well-known/oauth-protected-resource returns:

authorization_servers: the org tenant authority
scopes_supported: https://.crm.dynamics.com/api/mcp/mcp.tools
Auth should use the dynamically-registered client (e.g. the Microsoft GitHub Copilot App, aebc6443-996d-45c2-90f0-388ff96faa56) requesting scope …/api/mcp/mcp.tools, not Azure CLI / the generic Dataverse audience.

Evidence it's a client-side bug (server is correctly configured):

A direct MCP initialize to /api/mcp with a token for client aebc6443-… + scope mcp.tools returns 200 and a working session.
The refresh_token grant against that client + mcp.tools scope renews silently (HTTP 200), returning fresh tokens.
So the protected-resource metadata, the registered client, and refresh all work — the app is just using the wrong client/resource on the interactive (and refresh-fallback) path.
Impact:
Recurring auth-failure popups; risk of the MCP connection dropping at access-token expiry even when the Dataverse environment is fully configured (MCP client allow-listing enabled, valid mcp.tools token already issued).

Repro steps:

Register a remote Dataverse MCP server https://.crm.dynamics.com/api/mcp (Entra auth) in Copilot.
Trigger (re)authentication.
Browser returns AADSTS65002, naming client 04b07795-… and resource 00000007-….
Environment:

GitHub Copilot CLI 1.0.64-1, desktop bundle gh 2.95.0, git helper 2.53.0-3
OS: Windows
(Tenant ID, org URL, and Entra Trace/Correlation IDs available privately on request.)
Suggested fix:
On both initial interactive auth and token refresh for remote MCP servers, derive the client + scope from the server's /.well-known/oauth-protected-resource (use the registered/DCR client and the advertised …/mcp.tools scope) instead of defaulting to the Azure CLI client ID and the generic Dataverse resource.

---
| Field | Value |
| --- | --- |
| App version | 1.0.6 |
| OS | Windows 10.0.26200 |
| Theme | GitHub |
| Path | /chat |
| Tenure | Week 2 |

Bắt đầu bằng cách lấy metadata của máy chủ từ xa tại /.well-known/oauth-protected-resource và so sánh authorization server của nó cũng như scope /api/mcp/mcp.tools được quảng bá với các yêu cầu OAuth tương tác và fallback refresh. Truy vết cả hai đường dẫn xác thực remote MCP, sau đó xác minh rằng việc xác thực và gia hạn token sử dụng client và scope đã phát hiện, đồng thời yêu cầu khởi tạo MCP thành công mà không có AADSTS65002.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.