[ENHANCEMENT] Support custom OAuth callback paths and WWW-Authenticate metadata discovery for MCP servers #2218

Problem (one or two sentences)

Zoo Code cannot connect to some OAuth-protected MCP servers. The static OAuth client settings only accept a redirectUri with the /callback path, and discovery does not read the resource_metadata URL from the 401 response.

Context (who is affected and when)

This affects users of MCP servers that use a pre-registered OAuth client. The authorization server accepts only a fixed redirect URI, for example http://127.0.0.1:19876/mcp/oauth/callback. Zoo Code rejects this value with MCP OAuth redirectUri path must be /callback.

Some of these servers also host the protected resource metadata outside the RFC 9728 well-known URLs. The server sends the correct URL in the 401 WWW-Authenticate header, for example:

www-authenticate: Bearer resource_metadata="https://example.com/core/.well-known/oauth-protected-resource/mcp"

Zoo Code reads only the well-known URLs. It gets HTTP 404 and marks the server as a non-OAuth server. Users must use mcp-remote as a stdio bridge instead.

Desired behavior (conceptual, not technical)

• The oauth.redirectUri setting accepts a loopback URI with any callback path.
• OAuth discovery uses the resource_metadata URL from the 401 WWW-Authenticate header when the well-known URLs fail (RFC 9728 §5.1).

Constraints / preferences (optional)

Keep the current loopback, HTTP, and port checks for redirectUri. Keep the current behavior for servers without OAuth.