A test pins the MCP OAuth boundary: `parseRegistration` and `parseAuthRequest` refuse every bad redirect #6785

src/core/oauth.ts checks untrusted client registrations and authorize requests; no test calls parseRegistration or parseAuthRequest directly.

Done when a new test file proves:

• [ ] parseRegistration refuses a missing, empty or non-array redirect_uris, a non-string entry, a relative URI, a URI with a fragment, and a javascript: URI; it accepts an https URI and the loopback forms the module allows.
• [ ] parseAuthRequest refuses an unknown client, a redirect that is only a prefix of (or differs in case/trailing slash from) the registered one, a missing PKCE challenge, and a challenge method other than the one the module requires; it accepts an exact match.

Test only; a bug it finds is fixed in the same pull.