Serve the RFC 9728 protected-resource-metadata at the domain-root well-known URI the /mcp 401 challenge advertises.

RFC 8615 well-known URIs must live at the domain root, but mounting mcp_app under /mcp (above) nests FastMCP's own metadata route one level down. The earlier QSA-1268 stopgap 307-redirected here, which breaks strict OAuth clients (e.g. Claude Code) that do not follow redirects during discovery — they never reach the nested document and report a connection failure. Serving the document directly (200) at the advertised URI is what RFC 9728 requires; the nested FastMCP route stays as-is.

The origin-level path (no /mcp suffix) is also published: MCP Inspector probes it first and aborts OAuth when that probe returns 401 from the generic API auth middleware.