fix: exclude .well-known from auth middleware for MCP OAuth discovery (#76)

The .well-known/oauth-protected-resource and oauth-authorization-server
routes were caught by the auth middleware and redirected to /login,
preventing Claude Desktop from discovering the OAuth endpoints.

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

middleware.ts

@@ -15,6 +15,6 @@ export const config = {
      * - api (API routes - they handle their own auth)
      * - Static assets (images, scripts, manifest, icons, etc.)
      */
-    '/((?!_next/static|_next/image|favicon.ico|api|sw\\.js|sw-register\\.js|manifest\\.json|icons/|.*\\.(?:svg|png|jpg|jpeg|gif|webp|ico|js|json)$).*)',
+    '/((?!_next/static|_next/image|favicon.ico|api|\\.well-known|sw\\.js|sw-register\\.js|manifest\\.json|icons/|.*\\.(?:svg|png|jpg|jpeg|gif|webp|ico|js|json)$).*)',
   ],
 }