API root discovery probe (unauthenticated)

Returns 401 with a WWW-Authenticate Bearer hint pointing at OAuth protected-resource metadata. No token is accepted here: this is a discovery probe, not a tenant API. Agents act in workspaces through the authenticated MCP server at /mcp; see /auth.md.