fix: record an intercepted 401's status, headers and body (#2297)

The network tracker wrapped the auth-challenge interceptor, so a 401/403
never reached it as a response: the interceptor cancelled the body and
threw, and the tracker logged only the thrown error. NetworkEntry renders
its response section only when a status is present, so the body — and the
WWW-Authenticate resource_metadata and scope — were never shown.

Move the tracker below the interceptor so it records the real response and
clones its body before the interceptor cancels it, and stop awaiting that
cancel: with the tracker's clone as the other tee branch, the cancel settles
only once the clone reads to the end, which would hang on an unending body.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SG6q6YEDJyJB5H2Hr8nBDS
Signed-off-by: cliffhall <cliff@futurescale.com>

core/mcp/node/authChallengeFetch.ts

@@ -24,8 +24,11 @@ export function createAuthChallengeInterceptFetch(
     }
 
     // Release the connection before throwing so the SDK transport is not left
-    // with a half-read 401/403 body on streamable HTTP.
-    await response.body?.cancel().catch(() => {});
+    // with a half-read 401/403 body on streamable HTTP. Not awaited: when the
+    // network tracker sits below this wrapper (#2297) the body is one branch of
+    // a tee, and cancelling a branch settles only once the tracker's clone has
+    // read to the end — so a 401 whose body never ends would hang the throw.
+    void response.body?.cancel().catch(() => {});
 
     throw new AuthChallengeError(
       challenge,