/.well-known/oauth-protected-resource names the resource and its documentation (RFC 9728 resource_name, resource_documentation) #8335

A harness that discovers the MCP through OAuth metadata can show the user what they are connecting to. Today production answers only resource, authorization_servers, scopes_supported and bearer_methods_supported.

Done:

• [ ] The route in src/http/oauth.ts:139 adds resource_name (the forge's name, as the manifest's name) and resource_documentation (${origin}/llms.txt).
• [ ] The OAuth test asserts both, and that both are on the request's origin.

Files: src/http/oauth.ts, its test. Risk: none. Both fields are optional in RFC 9728, and clients ignore what they do not know.