…uired

The original code had two parallel paths to pull \`www_authenticate_header\`
out of an \`rmcp::ClientInitializeError\`, and both were dead code:

1. \`extract_auth_required\` walked \`std::error::Error::source()\` hoping to
   downcast to \`StreamableHttpError::AuthRequired\`, but
   \`ClientInitializeError::TransportError::error\` is not annotated with
   \`#[source]\`, so \`source()\` never reaches inside \`DynamicTransportError\`.
   A \`TODO(rmcp)\` comment blamed the missing annotation, but (a) that's
   hypothetical future work and (b) it isn't the right diagnosis — see #2.

2. \`extract_www_authenticate\` scraped \`e.to_string()\` for a
   \`www_authenticate_header: "..."\` marker. Also dead in practice:
   rmcp's \`Display\` for \`StreamableHttpError::AuthRequired\` is literally
   \`#[error("Auth required")]\` — the field name never appears in any
   Display layer of the chain, only in \`Debug\`. The scraper looked busy
   but never returned \`Some(_)\`.

Net effect: every auth-required MCP handshake silently went into OAuth
discovery with \`www_authenticate = None\`, so Tier 1 discovery
(resource_metadata from the header) was permanently skipped and we
always fell through to Tier 2 (\`.well-known\` on the server URL).

Fix: \`DynamicTransportError\` already exposes its
\`pub error: Box<dyn Error + Send + Sync>\` publicly, so we can match
\`ClientInitializeError::TransportError { error, .. }\` directly, then
\`downcast_ref::<StreamableHttpError<reqwest::Error>>()\` on the box.
The downcast reaches \`AuthRequired\` without any \`source()\` traversal
or upstream annotation changes.

- Replace both dead helpers with a single
  \`extract_auth_header_from_error\` that does the direct match + downcast.
- Keep the substring check (\`"401"\` / \`"Unauthorized"\` /
  \`"Auth required"\`) only as a defensive fallback so we don't regress
  if rmcp ever reshapes its chain.
- Drop the \`TODO(rmcp)\` comment (no longer blocked on upstream).
- Replace the two old unit tests with
  \`test_extract_auth_header_from_error_returns_none_for_non_transport_variant\`.
  The positive case can't be constructed from outside rmcp because
  \`AuthRequiredError\` is \`#[non_exhaustive]\`, but the negative-path test
  pins the "bail out on the wrong variant" invariant.

Closes #2401, #2402 — the bot issues auto-generated from the TODO
comment. The TODO is gone and the functionality it promised is now
actually present.

Verified: \`cargo test -p librefang-runtime-mcp --lib\` — 49 passed.
\`cargo clippy -p librefang-runtime-mcp --all-targets -- -D warnings\`
— clean.