One test walks an MCP client from nothing to a tool call, using only what the forge advertises #2484

Replaces #2392 (done on main in 9ebb3345). The pieces are each tested on their own: the 401 with resource_metadata, the protected-resource and authorization-server documents, /oauth/register, authorize with S256, and the token. No test follows them in order the way a new client must.

Done looks like:

• [ ] A new test/mcp-discovery-walk.test.ts, listed in GATE, starts from an unauthenticated MCP request. Each next URL is read from the previous answer, never hard-coded: 401 → resource_metadata → authorization server → registration_endpoint → authorization_endpoint (S256, as a signed-in consenting user) → token_endpoint → an MCP tools/list with the token answers 200.
• [ ] The same walk with plain as the challenge method is refused at authorize.
• [ ] No change to src/ unless the walk finds a document that points to the wrong place. If it does, fix that and name it.

Files: test/mcp-discovery-walk.test.ts (new), scripts/gate.ts. Risk: the consent step needs a session. Reuse the helpers in test/oauth-flow.test.ts.