No WWW-Authenticate header on 401, and no OAuth protected-resource metadata endpoint

[Jefferson49]

Issue was described in #29

May also related to #8

Specificaton:
https://modelcontextprotocol.io/specification/2025-06-18/basic/authorization