POST /mcp — Streamable HTTP (Bearer). OAuth: /.well-known/oauth-protected-resource, /authorize, /token, /register. GET /healthz.