Validate compliance with MCP “Authorization Server Metadata Discovery” requirements

We need to confirm that our Model Context Protocol (MCP) implementation within Toolhive correctly supports the Authorization Server Metadata Discovery section (covered under “Authorization Server Metadata Discovery” in the MCP spec). See the specification here: https://modelcontextprotocol.io/specification/draft/basic/authorization#authorization-server-metadata-discovery

Acceptance Criteria:

• The Toolhive MCP server exposes a Protected Resource Metadata document (per RFC 9728) that includes the authorization_servers field pointing to our authorization server(s).
• The MCP client logic is able to consume the authorization_servers field from resource metadata and use it to discover authorization-server metadata endpoints.
• Our MCP server supports returning a 401 Unauthorized response with a WWW-Authenticate header that includes resource_metadata="", allowing clients to discover the resource metadata URL.
  curity.io
• The MCP client supports discovery of authorization server metadata via /.well-known/oauth-authorization-server (or appropriate metadata URL) in accordance with the spec.
• Document any deviations from the spec or unsupported cases, along with mitigation plans.
• Automated tests are in place for the discovery logic (both resource metadata and authorization server metadata)

Start with the MCP Authorization Server Metadata Discovery specification and inspect Toolhive's existing MCP server and client authorization logic. Verify the resource metadata, WWW-Authenticate response, and authorization-server metadata discovery paths described in the acceptance criteria, then add automated tests for both discovery flows and document unsupported cases or mitigations.