fix(mcp): repair standalone OAuth login discovery

[aheritier]

Stacked on #3955/#3881. This intentionally combines PR4a–4c because discovery, credentials, and token-key behavior are coupled.

Summary:

• Forward the full latest.Remote.
• Match names and URLs exactly.
• Use authoritative challenge metadata, with path→root fallback only when metadata is absent.
• Require configured-only credentials for explicit ID/secret (no DCR); use DCR with no prompt when there is no ID.
• Preserve exact scopes across DCR, authorize, and RequestedScopes.
• Use Remote.URL verbatim as the resource/key.
• Add safe local httptest coverage.

Callback behavior is intentionally unchanged/deferred (PR4d/Q2). Documentation is planned in PR5.

No secrets, private test data, or logs are included.