Wire RFC 9728 resource_metadata discovery into Bearer 401 + observability

[jpr5]

Summary

• Bearer middleware 401s now include RFC 9728 resource_metadata on WWW-Authenticate (wires the dead unauthorizedWithDiscovery helper at src/oauth/handlers.ts:626, which had zero callers since landing).
• Adds 3 structured [oauth] bearer_failure reason=… log lines for observability — empty_token, the four typed JWT errors discriminated by instanceof (invalid_signature / expired / aud_mismatch / malformed_token), and the unknown fallthrough.
• Discovery endpoint .well-known/oauth-protected-resource already lives on this server, so no new endpoint work.

Spec: https://datatracker.ietf.org/doc/html/rfc9728

Red test output

Pre-substitution, the new RFC 9728 cases fail because the current unauthorized() emits no resource_metadata=:

 FAIL  src/__tests__/oauth-handlers.test.ts > bearerMiddleware > RFC 9728 resource_metadata discovery on 401 > empty Bearer token → 401 + resource_metadata
AssertionError: expected "vi.fn()" to be called with arguments: [ 'WWW-Authenticate', …(1) ]

Received:
  1st vi.fn() call:
  [
    "WWW-Authenticate",
-   StringContaining "resource_metadata=\"https://mcp.example.com/.well-known/oauth-protected-resource\"",
+   "Bearer realm=\"mcp\", error=\"invalid_token\"",
  ]

 FAIL  ... > invalid signature → 401 + resource_metadata
 FAIL  ... > expired token → 401 + resource_metadata
 FAIL  ... > aud mismatch → 401 + resource_metadata

 Test Files  1 failed (1)
      Tests  4 failed | 55 skipped (59)

Post-substitution: 4 passed, 0 failed, full repo suite green (Test Files 334 passed (334) | Tests 6248 passed (6248)).

Test plan

• New RFC 9728 resource_metadata discovery on 401 describe block in oauth-handlers.test.ts asserts WWW-Authenticate: Bearer resource_metadata="…/.well-known/oauth-protected-resource" on each Bearer failure mode (empty / signature / expired / aud).
• Pre-existing bearerMiddleware > expired token and oauth-e2e > garbage token updated to the new contract (error="invalid_token" moved from header to JSON body, mirroring what unauthorizedWithDiscovery was always emitting).
• npm test green locally + in CI.

Risk

None — discovery endpoint already live; substitution preserves 401 status code; unauthorized() helper retained (other callers may exist); no new infra. The header contract narrows from error="invalid_token" (RFC 6750 optional) to resource_metadata=… (RFC 9728 required for discovery) — bodies are unchanged.