docs: align mcp-oauth.md with the final 2026-07-28 MCP authorization spec

[heskew]

Once MCP 2026-07-28 promotes RC → stable (July 28), docs/mcp-oauth.md needs a pass to match. Code-side re-verification is already tracked in #156; this covers the doc gaps only:

• Update the spec reference (line 13) from 2025-06-18 to the final 2026-07-28 authorization spec, and re-verify all deep links — the authorization spec was restructured upstream (modelcontextprotocol#2858), so section anchors have moved.
• Note that RFC 7591 DCR is deprecated in 2026-07-28 in favor of Client ID Metadata Documents (12-month window, same PR as above). Our posture already matches — CIMD is default-on, /register is opt-in — but the doc presents DCR as the primary flow (flow diagram step 4, "The flow" §4, RFC table). Reframe CIMD as the primary registration path and DCR as the compat path.
• Fix the flow diagram: steps 1 and 7 show GET /mcp, but the 2026-07-28 Streamable HTTP transport removes the GET endpoint — all client requests are POSTs carrying Mcp-Method (and Mcp-Name for tools/call/resources/read/prompts/get). Worth a one-line mention that withMCPAuth is method-agnostic and unaffected.

Nothing here is a behavior change — the plugin's auth flow (per-request bearer, RFC 9728 challenge, RFC 8414 discovery) is unchanged in 2026-07-28; statelessness removes sessions we never used.

Refs: #156 (code-side final-spec re-verification) · 2026-07-28 changelog · RC announcement

🤖 Generated with Claude Code