- /oauth/register creates a public (PKCE) client; client_id uses 'mcpc_' prefix so it is
NOT accepted as a raw bearer by TokenManager::resolve() — only the human-approved JWT works
- registered redirect_uris stored + enforced exactly at /authorize
- registration_endpoint advertised in AS metadata
- fixes Claude.ai reconnect loop (DCR was missing; /oauth/register was 404)
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Q8t9GEyyLZbUQu26na1JQg