fix: add Protected Resource Metadata endpoint (RFC 9728)

The MCP auth spec (2025-06-18+) requires /.well-known/oauth-protected-resource
in addition to /.well-known/oauth-authorization-server. Claude fetches
the protected resource metadata first after receiving a 401, then discovers
the authorization server from it. Also fixes WWW-Authenticate header to
use absolute URL pointing to the protected resource endpoint.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/server/routes/oauth.ts

@@ -84,6 +84,16 @@ function renderLoginForm(params: {
 
 export const wellKnownRoute = new Hono<Env>();
 
+// Protected Resource Metadata (RFC 9728) — Claude fetches this first after 401
+wellKnownRoute.get("/oauth-protected-resource", (c) => {
+	const baseUrl = getBaseUrl(c);
+	return c.json({
+		resource: `${baseUrl}/mcp`,
+		authorization_servers: [baseUrl],
+	});
+});
+
+// OAuth Authorization Server Metadata (RFC 8414) — Claude fetches this second
 wellKnownRoute.get("/oauth-authorization-server", (c) => {
 	const baseUrl = getBaseUrl(c);
 	return c.json({