feat: auto-detect RFC 8707 resource parameter for OAuth flows

[technicalpickles]

Summary

Enable automatic detection of the RFC 8707 resource parameter from RFC 9728 Protected Resource Metadata, eliminating manual extra_params configuration for OAuth flows with providers like Runlayer/AnySource.

Related: #165 (zero-config-oauth branch work)

Problem

Runlayer/AnySource OAuth servers require the RFC 8707 resource parameter:

{"detail":[{"type":"missing","loc":["query","resource"],"msg":"Field required","input":null}]}

Previously users had to manually configure this:

{
  "oauth": {
    "extra_params": {
      "resource": "https://oauth.runlayer.com/api/v1/proxy/UUID/mcp"
    }
  }
}

Solution

Auto-detect resource from Protected Resource Metadata and inject it into:

1. OAuth authorization URL (query parameter)
2. Token exchange requests (form body)
3. Token refresh requests (form body)

After this PR (zero configuration):

{
  "name": "slack",
  "url": "https://oauth.runlayer.com/api/v1/proxy/UUID/mcp"
}

Implementation

1. Discovery Layer: Added DiscoverProtectedResourceMetadata() returning full RFC 9728 struct
2. Config Layer: Added CreateOAuthConfigWithExtraParams() returning extraParams with auto-detected resource
3. Connection Layer: Inject params into auth URL after mcp-go constructs it
4. Fallback: Use server URL as resource if metadata unavailable
5. Override: Manual extra_params takes precedence over auto-detected values
6. Diagnostics: mcpproxy auth status and mcpproxy doctor show resource detection status

Key Changes

• internal/oauth/discovery.go - Added DiscoverProtectedResourceMetadata()
• internal/oauth/config.go - Added CreateOAuthConfigWithExtraParams() and autoDetectResource()
• internal/upstream/core/connection.go - Updated OAuth flow call sites to use new API
• cmd/mcpproxy/auth_cmd.go - Added resource display to auth status
• internal/management/diagnostics.go - Updated doctor resolution message
• CLAUDE.md - Added zero-config OAuth documentation section

Planning Artifacts

• spec.md - Feature specification
• plan.md - Implementation plan
• research.md - Technical research
• data-model.md - Data model
• quickstart.md - Usage guide
• tasks.md - Task tracking

Status

• Specification complete
• Implementation plan complete
• Implementation complete (all 4 user stories)
• Unit tests
• E2E test with mock OAuth server
• Documentation updates (CLAUDE.md)
• Real-world validation with Runlayer/AnySource servers

Test Plan

• Unit tests for DiscoverProtectedResourceMetadata() - discovery_test.go
• Unit tests for resource auto-detection in CreateOAuthConfig() - config_test.go
• E2E test with mock OAuth server requiring resource parameter - e2e_oauth_zero_config_test.go
• Manual test with Runlayer/AnySource servers (slack, gcal, gdrive, etc.)
• Linter clean (./scripts/run-linter.sh)
• Full test suite passes (./scripts/run-all-tests.sh)

[technicalpickles]

I'm starting this early for visibilty while I work on it cc @Dumbris

Going to close #165 in favor for this

[technicalpickles]

Tested and verified working with Runlayer/AnySource MCP servers (slack, gcal, gdrive, gsheets, gmail, glean). Resource parameter is auto-detected from RFC 9728 Protected Resource Metadata and correctly injected into OAuth flows - no manual extra_params.resource configuration needed.

[Dumbris]

@technicalpickles Thanks for looping me in early on this.
Great contribution - the zero-config OAuth is a nice UX win. Code looks solid, tests are good. Nice push! 🚀
Merging as-is.

[technicalpickles]

@Dumbris thank you! would you mind cutting a release with it included? I'd love to share this with my coworkers also using runlayer/anysource.

[Dumbris]

@technicalpickles the release is now published https://github.com/smart-mcp-proxy/mcpproxy-go/releases/tag/v0.10.12
I haven’t tested it extensively yet, so feedback is welcome