feat(server): add request-time OAuth scope challenges (#1624)

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Claude <noreply@anthropic.com>

.changeset/scope-challenge-server.md

@@ -0,0 +1,22 @@
+---
+'@modelcontextprotocol/server': minor
+'@modelcontextprotocol/node': minor
+---
+
+Add request-time OAuth scope challenges for tools, resources, resource templates,
+and prompts. Each primitive's `scopeChallenge` callback receives the parsed
+request and verified authentication info, then either continues or returns the
+exact scope set for an `insufficient_scope` response. `requireScopes` provides a
+small helper for static all-of checks.
+
+`createMcpHandler` and Streamable HTTP transports return HTTP 403 with an
+`insufficient_scope` challenge before handler execution or SSE setup. The
+preflight is active whenever a registered primitive carries a `scopeChallenge`
+callback — there is no handler- or transport-level configuration. The
+challenge's `WWW-Authenticate` header is built by the same formatter as the
+bearer-auth 401/403 answers, and its `resource_metadata` parameter is derived
+from the verified `AuthInfo`: `requireBearerAuth` / `verifyBearerToken` now
+stamp their configured `resourceMetadataUrl` onto the `AuthInfo` they return
+(new optional `AuthInfo.resourceMetadataUrl` field), with a fallback to the
+well-known location for an HTTP(S) RFC 8707 `resource` identifier; the
+parameter is omitted when neither is available.