fix(auth): address review — reject a query or fragment in the metadata path

`isOriginRelativePath` compared the resolved href against the literal, which
`URL` preserves a query and fragment in — so `/doc?version=1` and `/doc#section`
passed. Express matches on the path alone (and treats `?` as a pattern
character), and a fragment never reaches the server, so the advertised URL
could not resolve to the registered route. Reject both, with cases added to
the table-driven test.

Signed-off-by: cliffhall <cliff@futurescale.com>

clients/web/src/test/integration/mcp/oauth-resource-metadata-challenge.test.ts

@@ -116,6 +116,11 @@ describe("OAuth challenge resource_metadata (RFC 9728)", () => {
     ["https://other-host/doc", false],
     ["custom/protected-resource", false],
     ["/has a space", false],
+    // `href` preserves both, so these pass an origin+href comparison — but
+    // Express matches on the path alone and a fragment never reaches the
+    // server, so the advertised URL could not resolve to the route.
+    ["/doc?version=1", false],
+    ["/doc#section", false],
     ["", false],
   ])("origin-relative path check: %j -> %s", (value, expected) => {
     expect(isOriginRelativePath(value)).toBe(expected);