Oauth Authorization Server Aggregate

OAuth authorization server discovery for the aggregate /mcp endpoint, the RFC 8414 path-inserted form for a client that treats {base}/mcp as its authorization base URL.

The single-segment /mcp is reserved for the aggregate so the discovery chain stays consistent: the aggregate protected-resource document advertises {base}/mcp as its authorization server, so the document served here must have issuer {base}/mcp. A server literally named mcp therefore does not take this route; it keeps its standard two-segment discovery at /.well-known/oauth-authorization-server/mcp/mcp. Letting the per-server row win here instead would serve an issuer of {base} against a resource that advertised {base}/mcp, which fails the RFC 8414 issuer check and breaks the front door.