Expand MCP conformance coverage to the interactive auth scenarios

[jancurn]

The reference @modelcontextprotocol/conformance suite (v0.1.16) ships 26 client scenarios. We now run 4 of them; sse-retry is implemented but excluded, and the remaining 21 are unimplemented — 20 of those are auth/*, against ~3,600 lines in src/lib/auth/, our most security-sensitive code.

Wiring up the two client-credentials scenarios immediately found a real bug (discovery never used RFC 9728 protected resource metadata, so an authorization server on a separate origin was unreachable without --token-endpoint), which suggests the rest are worth the effort.

Blocker for the remaining auth/* scenarios: they all drive the authorization-code grant, which opens a browser. The adapter needs to intercept the browser launch and drive the redirect itself. That scaffolding is the bulk of the work; once it exists the individual scenarios should be cheap to add.

Remaining, roughly in value order:

• Adapter scaffolding for non-interactive authorization-code login
• auth/metadata-default, auth/metadata-var1..3 — discovery layout variants
• auth/scope-* (5) — scope selection, step-up, retry limits
• auth/token-endpoint-auth-{basic,post,none}, auth/pre-registration, auth/basic-cimd
• auth/cross-app-access-complete-flow — SEP-990, matches login --grant id-jag (Add enterprise-managed authorization (ID-JAG) grant support #318)
• auth/2025-03-26-* backcompat, auth/resource-mismatch, auth/offline-access-*
• Fix or explicitly document the sse-retry reconnect timing issue, currently excluded from default runs

Out of scope: elicitation-sep1034-client-defaults — mcpc implements no elicitation, and never prompts for input by design.

Worth noting the framework's client scenarios currently top out at protocol 2025-11-25, so conformance runs exercise our legacy fallback path, not the 2026-07-28 era we negotiate by default. Nothing to do locally, but it limits what a green run proves.

Refs #329, #331