Merge origin/main into feature/oauth-discovery-routing

Brings the branch current with main (which carries the squash-merged
/mcp prefix-fix from #135). Caddyfile auto-merges cleanly: the @mcp
prefix-preserving block is textually identical on both sides, and this
branch's two .well-known OAuth discovery routes are preserved. No routes
dropped, no duplicates.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: gmr