fix(mcp): RFC 9728 protected-resource metadata path + audience binding

Codex/RFC review showed that Claude Desktop addresses the MCP resource
as <PUBLIC_URL>/mcp (the streamable-HTTP endpoint) rather than the
base URL. Per RFC 9728 the protected-resource metadata then lives at
.well-known/oauth-protected-resource inserted between host and path:

  https://mcp.buildmymcpserver.com/.well-known/oauth-protected-resource/<slug>/mcp

Runner template now:
  - publishes `resource: <PUBLIC_URL>/mcp`
  - sets WWW-Authenticate to the RFC 9728 well-known URL
  - serves /.well-known/oauth-protected-resource[/*] so the metadata
    answers at both the legacy and RFC paths during transition
  - accepts both audiences (<PUBLIC_URL>/mcp + <PUBLIC_URL>) during
    rollout so already-issued tokens keep working

API:
  - resolveServerByResource() tries port first, then path segment
    (production path-routing), with a guard against treating "mcp" as
    a tenant slug
  - AS metadata advertises resource_parameter_supported: true

nginx (scripts/setup-runner-tls.sh + scripts/bmm-mcp-runners.nginx):
  - new location matches /.well-known/oauth-protected-resource/<slug>/...
    and proxies to the slug's runner with the slug stripped, so the
    runner sees the local well-known path

Docs (oauth + api-reference) updated to the RFC paths.

apps/web/app/docs/oauth/page.tsx

@@ -24,8 +24,8 @@ export default function OAuthDocs() {
       <DocsH2 id="rfcs">Standards we follow</DocsH2>
       <DocsList>
         <DocsLi>OAuth 2.1 draft (<Mono>draft-ietf-oauth-v2-1</Mono>) — no implicit, mandatory PKCE</DocsLi>
-        <DocsLi>RFC 8414 — Authorization Server Metadata at <Mono>/.well-known/oauth-authorization-server</Mono></DocsLi>
-        <DocsLi>RFC 9728 — Protected Resource Metadata at <Mono>/.well-known/oauth-protected-resource</Mono></DocsLi>
+        <DocsLi>RFC 8414 — Authorization Server Metadata at <Mono>/.well-known/oauth-authorization-server/oauth</Mono></DocsLi>
+        <DocsLi>RFC 9728 — Protected Resource Metadata at <Mono>/.well-known/oauth-protected-resource/&lt;server-path&gt;</Mono></DocsLi>
         <DocsLi>RFC 8707 — Resource Indicators (audience binding)</DocsLi>
         <DocsLi>RFC 7591 — Dynamic Client Registration</DocsLi>
       </DocsList>
@@ -41,7 +41,7 @@ export default function OAuthDocs() {
         code={`$ curl -i http://localhost:4103/mcp -d '{}' -H 'content-type: application/json'
 
 HTTP/1.1 401 Unauthorized
-www-authenticate: Bearer resource_metadata="http://localhost:4103/.well-known/oauth-protected-resource"
+www-authenticate: Bearer resource_metadata="http://localhost:4103/.well-known/oauth-protected-resource/mcp"
 content-type: application/json
 
 {"error":"unauthorized"}`}
@@ -53,10 +53,10 @@ content-type: application/json
       </DocsP>
       <DocsCode
         label="step 2 — resource metadata"
-        code={`$ curl http://localhost:4103/.well-known/oauth-protected-resource
+        code={`$ curl http://localhost:4103/.well-known/oauth-protected-resource/mcp
 
 {
-  "resource": "http://localhost:4103",
+  "resource": "http://localhost:4103/mcp",
   "authorization_servers": ["http://localhost:4000/oauth"],
   "bearer_methods_supported": ["header"],
   "scopes_supported": ["mcp:read"]
@@ -74,7 +74,7 @@ content-type: application/json
   "client_name": "Claude Desktop",
   "redirect_uris": ["claude://oauth/callback"],
   "token_endpoint_auth_method": "none",
-  "resource": "http://localhost:4103"
+  "resource": "http://localhost:4103/mcp"
 }
 
 201 Created
@@ -94,7 +94,7 @@ content-type: application/json
   "code_verifier": "riSU-w1DT…",
   "client_id": "bmm_8aee2fe0…",
   "redirect_uri": "claude://oauth/callback",
-  "resource": "http://localhost:4103"
+  "resource": "http://localhost:4103/mcp"
 }
 
 200 OK
@@ -109,7 +109,7 @@ content-type: application/json
       <DocsP>
         Subsequent <Mono>/mcp</Mono> calls carry the JWT. The runner verifies the signature
         against the AS&apos;s JWKS, checks the <Mono>iss</Mono>, the <Mono>aud</Mono>
-        (RFC 8707 — must match the runner&apos;s own public URL), and the expiry. No token
+        (RFC 8707 — must match the runner&apos;s MCP resource URL), and the expiry. No token
         passthrough; the runner never forwards the client&apos;s token to a downstream API.
       </DocsP>