Auth Md

Auth.md agent-registration discovery (see auth.md's own spec). Deliberately does not claim OAuth, bearer tokens, API keys, or a registration/claim flow this marketplace doesn't have -- an earlier version of this route invented register_uri/claim_uri fields to chase a third-party readiness scanner's authMd check, which made the machine-readable surface less truthful, not more compatible. The correct fix was publishing a real (if minimal) RFC 9728 document at /.well-known/oauth-protected-resource that truthfully omits authorization_servers -- see that route -- and describing the real access model (anonymous discovery + x402 payment) honestly here instead.