OAuth token refresh hits the wrong endpoint when the auth server lives under a path

Ran into this with a hosted MCP server whose authorization server isn't at the origin root — token endpoint is https://host/oauth2/api/v1/token, not https://host/token.

If a client starts up with a cached-but-expired access token (+ refresh token) and hasn't done discovery yet, async_auth_flow refreshes at the very top — before any 401/metadata discovery. So oauth_metadata is None and _refresh_token uses the fallback urljoin(get_authorization_base_url(server_url), "/token"), i.e. just {scheme}://{netloc}/token. That 404s, _handle_refresh_response clears the tokens, and the flow drops to full interactive auth — which a headless/gateway client can't do. So the server silently disconnects every time the access token expires (mine are 5 min, so… constantly).

Same path-stripping fallback is in _get_token_endpoint, _perform_authorization_code_grant (/authorize) and DCR (/register) — refresh is just the one that bites silently.

Repro (roughly):

• MCP server whose AS metadata puts token_endpoint under a path, not {origin}/token
• log in normally so tokens get cached
• let the access token expire (or clear the expiry), reconnect with a fresh provider
• watch the refresh POST go to https://host/token → 404 → "Token refresh failed" → tokens cleared → it tries to open a browser

Fix looks like: discover metadata before the eager refresh (or stop dropping the issuer path in the fallback). Happy to PR — have a branch that pulls the PRM/ASM discovery out of the 401 branch and runs it before the refresh.

(used some AI help digging into this)

首先追蹤 async_auth_flow 及其到 _refresh_token 的 eager refresh 路徑，然後比較 _get_token_endpoint、_perform_authorization_code_grant 和 DCR 中的 fallback 行為。針對中繼資料端點包含路徑的 authorization server，重現快取中已過期 token 的情境。完成條件是 refresh 使用已探索到的 token endpoint，且不會清除有效 token 或回退到互動式驗證。