fix(auth): scope OAuth middleware to MCP

- restrict the OAuth and Basic challenge middleware to the MCP transport path
- preserve the standard Basic Auth prompt for UI and REST routes
- cover root and base-path deployments with routing regression tests