fix: plain 401 for MCP OAuth discovery (#74)

* fix: return plain 401 for MCP OAuth discovery and harden auth flow

- Return plain HTTP 401 with WWW-Authenticate header (no JSON-RPC body)
  so Claude Desktop's MCP client can trigger OAuth discovery correctly
- Remove unused apiKey import from authorize route
- Remove stale codeChallengeMethod parameter from oauth-codes

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: add Retry-After header to 429 rate limit response

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

app/api/mcp-oauth/authorize/route.ts

@@ -160,7 +160,6 @@ export async function POST(request: Request) {
   const redirectUri = url.searchParams.get('redirect_uri')
   const state = url.searchParams.get('state')
   const codeChallenge = url.searchParams.get('code_challenge') || ''
-  const codeChallengeMethod = url.searchParams.get('code_challenge_method') || 'S256'
 
   if (!redirectUri) {
     return NextResponse.json({ error: 'invalid_request' }, { status: 400 })
@@ -193,7 +192,6 @@ export async function POST(request: Request) {
   const code = createAuthCode({
     userId: user.id,
     codeChallenge,
-    codeChallengeMethod,
     redirectUri,
   })