[Client] Inject Bearer token into HttpTransport requests + handle 401 re-auth

Context

Once an access token is acquired (via any OAuth grant), every outbound JSON-RPC request on HttpTransport must carry Authorization: Bearer <token>. On a 401 Unauthorized mid-session, the transport must trigger a re-auth attempt and retry the failed request exactly once.

Scope

• src/Client/Transport/HttpTransport.php:
  • Read current token from TokenStorageInterface keyed by endpoint URL.
  • Add Authorization: Bearer <token> header on send() when a token is present.
  • On 401, parse WWW-Authenticate header, invoke auth coordinator, retry once.
• Introduce Mcp\Client\Auth\AuthCoordinator to orchestrate discovery → registration → token acquisition. (Implementation details land in dependent issues.)

Conformance scenarios unblocked

All auth/* scenarios depend on this wiring.

Dependencies

Blocked by: #315 (TokenStorageInterface).

Acceptance

• Unit tests for header injection + 401 retry behavior.
• Documented extension point for AuthCoordinator.

cc @soyuka

Start in src/Client/Transport/HttpTransport.php and review the TokenStorageInterface dependency from #315. Trace send() and the authentication coordinator entry point, then add unit coverage for Bearer header injection and one-time 401 re-auth retry. Done means requests use the current endpoint token, 401 responses trigger one retry, and the AuthCoordinator extension point is documented.