Fix MCP OAuth mission: Application ID URI cannot be a dev tunnel URL

[Elliot Margot (OwnOptic)]

Lab 1.2 of the "Secure an MCP Server with OAuth 2.0" mission asks you to open the HR MCP Server app in Entra ID and replace the Application ID URI with your dev tunnel URL. That edit cannot succeed. Microsoft Entra ID only accepts an https:// identifier URI whose host is a verified domain of the tenant, and devtunnels.ms cannot be verified by anyone, so the save fails with:

Values of IdentifierUris property must use a verified domain of the organization or its subdomain

The supported formats are listed in Restrictions on identifier URIs of Microsoft Entra applications. That page also notes a verified domain may still be required for the https:// scheme even when the tenant's identifier URI policy is switched off, so this is not something a learner can work around in their own tenant. This is what #3193 reports.

The step is also unnecessary. In this mission's own server under docs/special-ops/mcp-oauth/assets/hr-mcp-server-secured/:

• the authorization policy requires the scp claim to be the bare HR.Manage (Program.cs, HRMCPServerConfiguration.cs)
• realm comes from Audience, which is the server's client ID (Program.cs)
• the RFC 9728 resource value and the resource_metadata URL are built from the incoming request host, so the dev tunnel is picked up automatically (Program.cs)

Nothing reads the Application ID URI, so the mission works with the default api://<client-id> that Lab 1.2 already sets a few steps earlier.

What changed, in docs/special-ops/mcp-oauth/index.md:

• the "Update the Application ID URI and configuration" section becomes "Confirm the Application ID URI". It says to keep api://<client-id>, names the exact error, links the Learn page, and explains that the tunnel is still picked up from the request host.
• the appsettings.json scope and the Lab 1.4 note now use api://[YOUR_HR_MCP_SERVER_CLIENT_ID]/HR.Manage instead of [YOUR_DEVTUNNEL_URL]/HR.Manage.
• the optional Power Apps custom connector step now gives the Application ID URI as the Resource URL, for consistency with the above. That step is marked optional and I did not exercise it.

Verified: markdownlint-cli2 with the repo's .markdownlint.jsonc and cspell with the repo's cspell.json both report zero issues on the changed file, and the added Learn link returns 200. I also checked the sibling mcs-mcp mission, which uses the dev tunnel only as a server URL and has no Entra step, so it needs no change.

Closes #3193