fix(mcp): RFC 9728 protected-resource metadata path + audience binding

Codex/RFC review showed that Claude Desktop addresses the MCP resource
as <PUBLIC_URL>/mcp (the streamable-HTTP endpoint) rather than the
base URL. Per RFC 9728 the protected-resource metadata then lives at
.well-known/oauth-protected-resource inserted between host and path:

  https://mcp.buildmymcpserver.com/.well-known/oauth-protected-resource/<slug>/mcp

Runner template now:
  - publishes `resource: <PUBLIC_URL>/mcp`
  - sets WWW-Authenticate to the RFC 9728 well-known URL
  - serves /.well-known/oauth-protected-resource[/*] so the metadata
    answers at both the legacy and RFC paths during transition
  - accepts both audiences (<PUBLIC_URL>/mcp + <PUBLIC_URL>) during
    rollout so already-issued tokens keep working

API:
  - resolveServerByResource() tries port first, then path segment
    (production path-routing), with a guard against treating "mcp" as
    a tenant slug
  - AS metadata advertises resource_parameter_supported: true

nginx (scripts/setup-runner-tls.sh + scripts/bmm-mcp-runners.nginx):
  - new location matches /.well-known/oauth-protected-resource/<slug>/...
    and proxies to the slug's runner with the slug stripped, so the
    runner sees the local well-known path

Docs (oauth + api-reference) updated to the RFC paths.

scripts/bmm-mcp-runners.nginx

@@ -0,0 +1,80 @@
+# BMM per-runner proxy via PATH routing on mcp.buildmymcpserver.com.
+# The combined snippet file (regenerated by the bmm-api and bmm-generator
+# containers + reloaded by the systemd inotify watcher) is a sequence of
+# `if ($bmm_slug = "<slug>") { set $bmm_port <port>; }` lines that map the
+# slug captured from the URL path to the local runner port.
+
+server {
+  listen 80;
+  listen [::]:80;
+  listen 443 ssl http2;
+  listen [::]:443 ssl http2;
+  server_name mcp.buildmymcpserver.com;
+
+  ssl_certificate     /etc/ssl/buildmymcpserver/mcp-runners.crt;
+  ssl_certificate_key /etc/ssl/buildmymcpserver/mcp-runners.key;
+
+  client_max_body_size 4M;
+
+  # Cheap health probe for monitoring — doesn't go through the slug router.
+  location = /health {
+    return 200 "ok\n";
+    add_header Content-Type text/plain;
+  }
+
+  # RFC 9728 for path-routed resources:
+  # /<slug>/mcp derives metadata at /.well-known/oauth-protected-resource/<slug>/mcp.
+  # Route that well-known URL back to the same runner while preserving only the
+  # resource sub-path after the slug.
+  location ~ ^/\.well-known/oauth-protected-resource/(?<bmm_slug>[a-z0-9][a-z0-9-]*)(?<bmm_path>/.*)?$ {
+    set $bmm_port "";
+    include /opt/buildmymcpserver/runner-map.combined;
+
+    if ($bmm_port = "") {
+      return 404;
+    }
+
+    proxy_pass http://127.0.0.1:$bmm_port/.well-known/oauth-protected-resource$bmm_path;
+    proxy_http_version 1.1;
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto https;
+    proxy_buffering off;
+    proxy_cache off;
+    proxy_read_timeout 600s;
+  }
+
+  # /<slug>/<rest> → 127.0.0.1:<port>/<rest>
+  location ~ ^/(?<bmm_slug>[a-z0-9][a-z0-9-]*)(?<bmm_path>/.*)?$ {
+    set $bmm_port "";
+    include /opt/buildmymcpserver/runner-map.combined;
+
+    # Unknown slug — return 404 instead of a confusing default.
+    if ($bmm_port = "") {
+      return 404;
+    }
+
+    # Default sub-path to /  when client asked for /<slug> with no trailing slash.
+    set $bmm_target_path $bmm_path;
+    if ($bmm_target_path = "") {
+      set $bmm_target_path "/";
+    }
+
+    proxy_pass http://127.0.0.1:$bmm_port$bmm_target_path;
+    proxy_http_version 1.1;
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto https;
+    # MCP uses Streamable HTTP — disable buffering so response chunks flow.
+    proxy_buffering off;
+    proxy_cache off;
+    proxy_read_timeout 600s;
+  }
+
+  # Root of mcp.buildmymcpserver.com — nothing to serve here.
+  location = / {
+    return 404;
+  }
+}