Fix legacy OAuth discovery fallback for path-based MCP URLs

[patvice]

Problem

Some MCP servers (for example Atlassian at https://mcp.atlassian.com/v1/sse) do not expose path-based protected resource metadata or path-based auth-server metadata. Our discovery flow could fail through to default /authorize and /token endpoints instead of using provider metadata.

In this case, root auth metadata exists at /.well-known/oauth-authorization-server, but its issuer can differ from the MCP base URL.

Solution

• Added a legacy fallback discovery pass that retries auth-server metadata using the MCP base URL origin when path-based discovery fails.
• In that legacy fallback path, accept issuer mismatch metadata and log it at info for compatibility.
• Added/updated discovery specs to cover the Atlassian-style fallback behavior.

closes #127