fix(auth): address review — proxy CIMD discovery fetch, validate metadata path

Two findings from review:

- `ensureCimdClientRegistration` ran protected-resource discovery on the
  global fetch while its AS-metadata leg used the configured one. On web
  that is `createRemoteFetch`, which proxies through the backend to sidestep
  CORS — so the discovery this PR routes to a challenge-advertised URL would
  fail in the browser, be swallowed by the catch, and leave CIMD probing the
  wrong authorization server. Forward `params.fetchFn`, and assert in the
  test that nothing reaches the global.

- `oauth.resourceMetadataPath` accepted `//other-host/doc`. Resolved against
  the request base that re-points the origin in the advertised
  `resource_metadata` while Express still registers the route locally, so the
  server would advertise a document it does not serve. `/\\host` does the
  same, since the URL parser folds a backslash into a slash for special
  schemes — a leading-slash check misses both. Validate origin-relativity
  with a shared predicate, used by the JSON-config validator and again at
  server setup for a programmatically built ServerConfig.

Signed-off-by: cliffhall <cliff@futurescale.com>

test-servers/src/load-config.ts

@@ -6,6 +6,7 @@
 import { readFileSync } from "fs";
 import path from "path";
 import YAML from "yaml";
+import { isOriginRelativePath } from "./test-server-oauth.js";
 
 export interface PresetRef {
   preset: string;
@@ -203,12 +204,9 @@ function validateConfig(
       }
     }
     const metadataPath = oauth.resourceMetadataPath;
-    if (
-      metadataPath !== undefined &&
-      (typeof metadataPath !== "string" || !metadataPath.startsWith("/"))
-    ) {
+    if (metadataPath !== undefined && !isOriginRelativePath(metadataPath)) {
       throw new Error(
-        `Invalid config in ${filePath}: oauth.resourceMetadataPath must be an absolute path starting with "/"`,
+        `Invalid config in ${filePath}: oauth.resourceMetadataPath must be an origin-relative path (e.g. "/custom/protected-resource") — a value such as "//host/doc" would advertise a document the server does not serve`,
       );
     }
     if (transportType === "stdio" && oauth.enabled === true) {