Offset OAuth: sign-in for MCP clients. Metadata: /.well-known/oauth-authorization-server