fix: enforce the OAuth deadline across the proxy hop (#2319 round 5)

Two findings, both real.

The race bounded only the caller's promise on the browser path.
`createRemoteFetch` dropped the signal, so an abort — including the
deadline's own — left the POST to /api/fetch in flight; the backend
never saw its request cancelled and its outbound fetch ran on with
neither signal nor timeout, holding a handler and an authorization-server
socket per timed-out attempt. `createRemoteFetch` now forwards the
caller's signal (init.signal when present and not undefined, else a
Request's own), and the /api/fetch route composes `c.req.raw.signal`
with a server-side deadline matching the client budget, cleared in
`finally` so a streaming response is not severed.

A probe's own timeout was swallowed by `withRfc8414OidcCompat`, which
returned the preceding 404 and discarded the endpoint name the deadline
exists to provide. A deadline the Inspector imposed is its own error,
not the server's answer, so it escapes now; every other probe failure
still falls back as documented. Nothing regresses: every candidate the
loop probes is one the SDK's own buildDiscoveryUrls emits, so a stall
there is one the SDK would have hit itself, unbounded.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YFnM6RqB4nXqNysgUYmjmq
Signed-off-by: cliffhall <cliff@futurescale.com>

core/auth/oidcDiscoveryCompat.ts

@@ -90,6 +90,7 @@
  * wiring in `core/mcp/inspectorClient.ts`.
  */
 
+import { OAuthRequestTimeoutError } from "./requestTimeout.js";
 import {
   OAuthMetadataSchema,
   OpenIdProviderDiscoveryMetadataSchema,
@@ -262,7 +263,18 @@ export function withRfc8414OidcCompat(fetchFn: typeof fetch): typeof fetch {
       let probe: Response;
       try {
         probe = await fetchFn(candidate, { headers });
-      } catch {
+      } catch (err) {
+        // A deadline the Inspector imposed is *our* error, not the server's
+        // answer, so it escapes rather than being folded back into the original
+        // response (#2319, Copilot). Swallowing it would hand the caller the
+        // preceding 404 and discard the one thing the deadline adds — the name
+        // of the endpoint that stalled — leaving discovery to fail later under
+        // a message that points at the wrong URL. There is no flow this can
+        // break that was not already broken: every candidate this loop probes
+        // is one the SDK's own `buildDiscoveryUrls` emits, so a stall here is a
+        // stall the SDK would have hit itself, unbounded. Everything else — a
+        // CORS rejection, DNS, a reset — still falls back as documented above.
+        if (err instanceof OAuthRequestTimeoutError) throw err;
         return response;
       }
       if (!probe.ok) {