fix: restore eager OAuth discovery to avoid slow unauthenticated roundtrip

[BabyChrist666]

Summary

Fixes #1274

• When the client has no valid tokens but has existing client_info (i.e., has been through the OAuth flow at least once), performs OAuth discovery and authorization before sending the MCP request (eager flow), eliminating the unnecessary unauthenticated roundtrip that servers like Notion handle slowly (~10s latency per operation)
• Extracts _perform_oauth_discovery_and_auth() helper shared by both the eager (pre-request) and reactive (post-401) paths, keeping code DRY while preserving RFC 9728 WWW-Authenticate header support on the 401 path
• Adds dedicated tests for the eager OAuth flow behavior and updates existing tests that validate the reactive 401 path

Root Cause

Between v1.11.0 and v1.12.0, the client OAuth flow changed from eager discovery (discover → authenticate → send MCP request) to lazy discovery (send MCP request → get 401 → discover → authenticate → retry). This causes a slow unauthenticated roundtrip to the MCP server before OAuth even begins, which some servers (e.g. Notion) handle very slowly.

Approach

The fix introduces conditional eager OAuth:

• First connection (no client_info): Uses the reactive 401 path as before, since the server's WWW-Authenticate header may carry routing information (e.g. resource_metadata URL) that pure well-known discovery lacks
• Subsequent connections (has client_info but expired/missing tokens): Runs the full discovery/registration/authorization flow eagerly BEFORE sending the MCP request, avoiding the slow unauthenticated roundtrip
• If the eager flow fails (e.g. resource mismatch, registration error), it falls through gracefully to the reactive 401 path

Both paths share a single _perform_oauth_discovery_and_auth() helper method.

Test plan

• All 100 auth tests pass (including scope bug OAuth2: Protected-resource URL passed as scope instead of parsed scope #1630 regression test)
• New test_eager_oauth_flow_avoids_unauthenticated_roundtrip validates the eager flow end-to-end
• New test_eager_oauth_falls_back_on_error validates graceful fallback when eager flow fails
• Updated 3 legacy/SEP-985 fallback tests and scope regression test (OAuth2: Protected-resource URL passed as scope instead of parsed scope #1630) to use stale tokens for reactive 401 path testing
• pyright: 0 errors, 0 warnings
• ruff: all checks passed

🤖 Generated with Claude Code