The MCP's 401 is one challenge from one function: it names the scopes, and says invalid_token when a presented token is expired or revoked #8362

A harness can tell "sign in" from "your token is dead, re-authorize" without guessing. Today the challenge string is built in two places (src/http/oauth.ts:46 and src/http/mcp.ts:385). Neither carries scope, and an expired token gets the same bare challenge as no token at all.

Done:

• [ ] One exported function in src/http/oauth.ts builds the WWW-Authenticate value, and src/http/mcp.ts calls it.
• [ ] The value adds scope="ro rw" (from OAUTH_SCOPES), and error="invalid_token" when a bearer was sent and refused (RFC 6750 §3).
• [ ] A test asserts the header for no token, a garbage token and an expired token, on /mcp and on the API route that already uses the oauth.ts challenge.

Files: src/http/oauth.ts, src/http/mcp.ts, a new test/oauth-challenge.test.ts. Risk: keep resource_metadata exactly as it is. Clients key discovery on it.