feat: add OAuth proxy support to eliminate CORS issues

Add server-side proxy endpoints for OAuth discovery, client registration,
and token exchange to avoid CORS issues when using proxy connection mode.

Server proxy endpoints:
- GET /oauth/resource-metadata - proxies OAuth protected resource metadata
- GET /oauth/metadata - proxies OAuth authorization server metadata
- POST /oauth/register - proxies dynamic client registration
- POST /oauth/token - proxies token exchange

Client changes:
- Construct correct RFC 9728/8414 path-aware well-known URLs client-side
- Route all OAuth discovery through proxy when in proxy connection mode
- Eliminate direct browser fetches that fail with CORS in proxy mode

client/src/lib/hooks/useConnection.ts

@@ -64,6 +64,7 @@ import {
   clearScopeFromSessionStorage,
   discoverScopes,
 } from "../auth";
+import { discoverOAuthProtectedResourceMetadataViaProxy } from "../oauth-proxy";
 import {
   getMCPProxyAddress,
   getMCPTaskTtl,
@@ -404,13 +405,26 @@ export function useConnection({
         // Only discover resource metadata when we need to discover scopes
         let resourceMetadata;
         try {
-          resourceMetadata = await discoverOAuthProtectedResourceMetadata(
-            new URL("/", sseUrl),
-          );
+          if (connectionType === "proxy") {
+            resourceMetadata =
+              await discoverOAuthProtectedResourceMetadataViaProxy(
+                sseUrl,
+                config,
+              );
+          } else {
+            resourceMetadata = await discoverOAuthProtectedResourceMetadata(
+              new URL("/", sseUrl),
+            );
+          }
         } catch {
           // Resource metadata is optional, continue without it
         }
-        scope = await discoverScopes(sseUrl, resourceMetadata);
+        scope = await discoverScopes(
+          sseUrl,
+          connectionType,
+          config,
+          resourceMetadata,
+        );
       }
 
       saveScopeToSessionStorage(sseUrl, scope);