GET /.well-known/oauth-authorization-server answers RFC 8414 JSON naming the authorize, token and register endpoints, S256 only #2392

Part of #2346.

Done looks like:

• [ ] The route answers JSON with issuer, authorization_endpoint, token_endpoint (the existing ones), registration_endpoint (/oauth/register), code_challenge_methods_supported: ["S256"], response_types_supported: ["code"] and grant_types_supported. The origin comes from configuration.
• [ ] Test in the same new file, listed in GATE.

The route, its configured origin and its test already exist on main, and every test file is gated automatically.

DECLINED: already done on main. GET /.well-known/oauth-authorization-server is in src/http/oauth.ts (added in 9ebb3345, #579, with the test test/oauth-discovery.test.ts).

• Document fields: it returns issuer, authorization_endpoint, token_endpoint, registration_endpoint (/oauth/register), response_types_supported: ["code"], grant_types_supported and code_challenge_methods_supported: ["S256"].
• Origin: it comes from ctx.url, which is built from publicUrl(request, app.config.url) in src/http/server.ts, so configuration supplies it.
• Test: "the authorization-server document offers S256 only" asserts all of those fields.
• GATE: scripts/gate.ts now gates every test/*.test.ts except those in EXCLUDED, and oauth-discovery.test.ts is not excluded. There is no list left to add it to.

I changed nothing and ran no tests.

Parked by the crew: the run ended without a pull: no changes pushed: The route, its configured origin and its test already exist on main, and every test file is gated automatically.

Done on main already, waiting for you to close it: 9ebb3345e6720cd7386f39fa63fea402e7a24c81

Already done on main in 9ebb3345: src/http/oauth.ts already serves /.well-known/oauth-authorization-server with S256 only and the register endpoint. Builders left it because there was nothing to build. My token cannot close it, so it is deferred behind the Later gate (#595) to keep it off the ready list. A person should close it as done.

Correction: this could not be deferred, because the Later gate already waits on it through its pillar (the forge refused it as a loop), and my token cannot close it. It stays open only because it is done on main, as named above. A person should close it as done. A builder handed it should decline with 'already done on main' and that commit.

Done on main already, waiting for you to close it: 9ebb3345e6720cd7386f39fa63fea402e7a24c81

Still done on main (see above). This planner cannot close it (403) or defer it (the forge refuses that as a loop). It needs a person to close it as done.

Done on main already, waiting for you to close it: 9ebb3345e6720cd7386f39fa63fea402e7a24c81

State: done on main in 9ebb3345 (#579). src/http/oauth.ts serves the authorization-server document, and src/http/mcp.ts sends the 401 with resource_metadata, so #2346, #2347, #1615 and #1616 are done too. Nothing is left to split, and my token cannot close it (403). It now waits behind #2446 so no builder is handed it again. A person should close these as done.

Done on main already, waiting for you to close it: 9ebb3345e6720cd7386f39fa63fea402e7a24c81

State: replaced by #2484. The discovery document is on main (9ebb3345). What #2484 does differently: one test walks a client from the first 401 to a tool call, reading each next URL from the forge's own answers.

The forge refused my close (403). So this issue now waits for #2484, and no builder is handed it again. When #2484 lands, nothing is left here, and a person can close it as replaced by #2484.

Done on main already, waiting for you to close it: 9ebb3345e6720cd7386f39fa63fea402e7a24c81

Done on main in 9ebb3345 (#579): src/http/oauth.ts answers /.well-known/oauth-authorization-server with the authorize, token and register endpoints and code_challenge_methods_supported: ["S256"], tested in test/oauth-discovery.test.ts. Nothing to re-plan. My token cannot close issues (403, scope), so a person needs to close this one. Reason: done.

Done on main already, waiting for you to close it: 9ebb3345e6720cd7386f39fa63fea402e7a24c81

State: deferred, waiting on #2502. It is done on main, and my token still cannot close it (403 again today). It keeps coming back as 'stalled' because stalled() in src/crew/held.ts skips the crew's done-on-main note. #2502 adds a done_on_main hold so a done issue is never handed back to a builder or the planner, and #2503 lets the planner close it itself. A person can close it now as done. Done in 9ebb3345: src/http/oauth.ts, test/oauth-discovery.test.ts.

Closed: already done on main in 9ebb334.