feat(auth): carry WWW-Authenticate resource_metadata on API entry-point 401s (RFC 9728 discovery)

From the 2026-07-05 orank scan: `agent-auth-www-authenticate` (bonus, estScoreGain **0**) probes API entry points (`/api`, `/api/v1`, `/mcp`, `api.worldmonitor.app/...`) for a 401 carrying:

```
WWW-Authenticate: Bearer resource_metadata="https://worldmonitor.app/.well-known/oauth-protected-resource"
```

We already publish the protected-resource metadata document — this is just the spec-shaped (RFC 9728 §5) pointer on the 401 itself, so an agent learns the auth requirements from one request instead of hunting for the well-known doc.

Deliberately deferred from the bucket A pass (#4820/#4824/#4838): orank reports zero score gain, and it touches the gateway/MCP auth response path (contract-test-pinned), so it's spec-correctness work, not score work. `api/mcp/auth.ts` already exports a `wwwAuthHeader` helper — likely most of the job.

https://claude.ai/code/session_016LG2b5W6EH7mEGSxuRGUry

Start in api/mcp/auth.ts, where the existing wwwAuthHeader helper is exported, and trace the gateway/MCP authentication response path for API entry-point 401s such as /api, /api/v1, and /mcp. Review the contract tests that pin this response, then verify that qualifying 401s carry the RFC 9728 resource_metadata pointer to the published protected-resource document.

Written by the indexing model from the issue text.