fix(http): preserve CORS across OAuth routes

Apply the browser CORS contract at the root router so authentication, metadata, error, and fallback responses retain the required headers. Register protected-resource metadata for every MCP route variant and verify each challenge round trip.\n\nRefs #3095\n\nCo-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>