Add client credentials support to everything-client (#89)

* Add client credentials support to everything-client

- Add ConformanceContextSchema with discriminated union for auth contexts
- Add runClientCredentialsJwt and runClientCredentialsBasic handlers
- Update runner to include scenario name in context for discriminated union parsing
- Update test helpers to set env vars for inline client runners
- Fix JWT audience validation to match SDK behavior (no trailing slash)
- Remove client credentials scenarios from skip list

* Accept both trailing slash forms for JWT audience per RFC 3986

Per RFC 3986, URLs with and without trailing slash are equivalent.
The MCP spec recommends (SHOULD) the form without trailing slash, but
since it's not a MUST, the conformance test should accept both forms
for interoperability with clients like Pydantic that normalize URLs.

* Remove .vscode from tracking and add to gitignore

* Address review feedback

- Remove unused issuerUrl variable and comment
- Simplify audience array to exactly 2 values with clearer naming
- Add comment explaining strip-then-add-back logic
- Rename ConformanceContextSchema to ClientConformanceContextSchema

* Remove dist from tracking and add to gitignore

* Fix .gitignore formatting

* Add getHandler to everything-client for cleaner test imports

Instead of importing individual handlers, tests can now import getHandler
and look up handlers by scenario name.

* Use getHandler exclusively, remove goodClient import

- Add CIMD support to runAuthClient in everything-client
- Add auth fallback to getHandler for unregistered auth/* scenarios
- Remove goodClient import from test file

* Remove runAuthClient fallback, register all auth scenarios explicitly

src/scenarios/client/auth/client-credentials.ts

@@ -50,10 +50,6 @@ export class ClientCredentialsJwtScenario implements Scenario {
       tokenEndpointAuthMethodsSupported: ['private_key_jwt'],
       tokenEndpointAuthSigningAlgValuesSupported: ['ES256'],
       onTokenRequest: async ({ grantType, body, timestamp, authBaseUrl }) => {
-        // Per RFC 7523bis, the audience MUST be the issuer identifier
-        const issuerUrl = authBaseUrl.endsWith('/')
-          ? authBaseUrl
-          : `${authBaseUrl}/`;
         if (grantType !== 'client_credentials') {
           this.checks.push({
             id: 'client-credentials-grant-type',
@@ -97,9 +93,16 @@ export class ClientCredentialsJwtScenario implements Scenario {
 
         // Verify JWT signature and claims using the generated public key
         try {
-          // Per RFC 7523bis, audience MUST be the issuer identifier
+          // Per RFC 7523bis, audience MUST be the issuer identifier.
+          // Per RFC 3986, URLs with and without trailing slash are equivalent,
+          // so we accept both forms for interoperability (e.g. Pydantic normalizes
+          // URLs by adding trailing slashes).
+          // Strip any trailing slashes first, then accept both the bare form
+          // and the form with exactly one trailing slash.
+          const withoutSlash = authBaseUrl.replace(/\/+$/, '');
+          const withSlash = `${withoutSlash}/`;
           const { payload } = await jose.jwtVerify(clientAssertion, publicKey, {
-            audience: issuerUrl,
+            audience: [withoutSlash, withSlash],
             clockTolerance: 30
           });