Publish the OAuth identifiers the operator configured, not a normalised copy of them

[Cloto-dev]

The discovery document published an authorization server identifier the
operator had not configured. Measured against the live deployment: the
configured value carries no trailing slash, the published one did, and the
authorization server itself reports the configured form.

Why this is a defect rather than a spelling difference

RFC 8414 §3.3, verbatim:

The "issuer" value returned MUST be identical to the authorization server's
issuer identifier value into which the well-known URI string was inserted to
create the URL used to retrieve the metadata. If these values are not
identical, the data contained in the response MUST NOT be used.

The comparison is against the string the client started from — the one this
document handed it. An authorization server whose issuer has no path returns
it without a slash forever, so a conformant client must refuse the metadata it
just fetched. RFC 9728 §3.3 places the same requirement on resource; that
half stayed invisible because the deployed resource carries a path, and the
normalisation only rewrites identifiers that have none.

Two causes, and why neither fix works alone

Both were measured, not reasoned about:

Change	Published
Neither half	https://as.example/
Preserve the operator's string only	https://as.example/
Set the model flag only	https://as.example/
Both	https://as.example

This server converted the strings to the normalising URL type before handing
them over, and the SDK's metadata models are themselves typed with it. The
second is not ours: upstream fixed it in modelcontextprotocol/python-sdk#2925
(closing #2883) with a single url_preserve_empty_path flag, and it ships in
SDK 2.0 — a major upgrade this server has not taken. Rather than hand-write a
document whose whole value is that clients already parse it, the same flag is
set on the same models at startup. It is skipped where the SDK already carries
it, so it retires itself when that upgrade lands.

Verification

• 1,307 passed / 5 skipped; issue registry clean; docs facts and mutation waivers OK
• New tests configure four spellings (with and without a path, with and
  without a terminating slash) and assert the served document reproduces each,
  plus the multi-server ordering case and resource
• Mutation-tested per half: removing either the preserved strings or the
  model flag turns 5 tests red — the same 5 either way, which is the point
• Validation is unchanged: a malformed issuer still disables discovery with a
  warning, pinned by a test, since publishing verbatim means nothing
  downstream would catch a typo
• Two existing tests had encoded the normalised form. Their subjects were the
  public route and the list separators; the expectations were written around
  what the code did (AUTH_SERVER + "/"), and are corrected with a pointer to
  the reason.