fix(mcp): eager-auth flag so claude.ai's connector dialog detects OAuth, not "None" (#2159)

claude.ai's two-step "Add custom connector" dialog probes the server URL
without credentials and pre-fills the Authentication choice from the
answer. Our lazy-auth endpoint (issue #1814) answers 200 on an anonymous
initialize, which the dialog reads as an authless server: it suggests
"None", and a connector added with that default never opens the sign-in
when the challenge arrives later. Per Anthropic's connector docs a 401 is
the only answer it reads as OAuth ("Claude does not honor a
WWW-Authenticate header on a 200 response").

- `auth=required` on the endpoint URL (extensions/general/mcp-server/
  auth-mode.ts) turns lazy auth off for that URL: every tokenless
  request, initialize included, answers the 401 + WWW-Authenticate
  challenge. Callers with a token are unaffected; the bare URL keeps
  lazy auth for Claude Code, the plugin, Cursor and ChatGPT, and existing
  connector records are untouched.
- The links we control carry the flag: Settings -> API & MCP (install
  link and copy block), the onboarding checklist, both docs pages and
  claude-plugin/CONNECTORS.md (plugin 1.2.3). The docs' Path A now
  describes the eager flow (sign-in opens on Add) instead of telling
  users to override the dialog's "None".
- Tests: eager-auth.test.ts (401 on initialize/tools/list/public tools,
  namespaced metadata pointer, token no-op, exact-flag only); checklist
  link shape updated.

Companion: gnubok-website PR (Kom igång connector link + regenerated
connect-claude / anslut-claude pages).


Claude-Session: https://claude.ai/code/session_013yw62FMXGSzo6icFDiBwP3

Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com>
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>

components/settings/ApiKeysPanel.tsx

@@ -313,6 +313,13 @@ export function ApiKeysPanel() {
   // distribution marker (server reads it; never used for auth).
   const mcpUrl = (client: string) =>
     `${mcpBase}?tool_namespace=accounted&client=${client}`
+  // claude.ai's Add-custom-connector dialog probes the URL without credentials
+  // and pre-fills Authentication "None" when the lazy handshake answers 200,
+  // which blocks the sign-in later. `auth=required` makes every tokenless
+  // request answer the 401 challenge so the dialog detects OAuth instead
+  // (extensions/general/mcp-server/auth-mode.ts). Claude Code, Cursor and the
+  // stdio bridge keep the lazy URL.
+  const claudeConnectorUrl = `${mcpUrl('claude-connector')}&auth=required`
 
   // claude.ai install link: opens Add-custom-connector with name and URL
   // prefilled. It only prefills the dialog, so the user still reviews and
@@ -322,7 +329,7 @@ export function ApiKeysPanel() {
   const claudeInstallUrl =
     'https://claude.ai/customize/connectors?modal=add-custom-connector' +
     `&connectorName=${encodeURIComponent(branding.appName)}` +
-    `&connectorUrl=${encodeURIComponent(mcpUrl('claude-connector'))}`
+    `&connectorUrl=${encodeURIComponent(claudeConnectorUrl)}`
 
   return (
     <>
@@ -419,7 +426,7 @@ export function ApiKeysPanel() {
                   path: (chunks) => <strong>{chunks}</strong>,
                 })}
               </p>
-              <CopyBlock text={mcpUrl('claude-connector')} copyAriaLabel={t('copy_aria')} />
+              <CopyBlock text={claudeConnectorUrl} copyAriaLabel={t('copy_aria')} />
             </div>
 
             <div>