feat: point auth.md and the Link header at the real oauth-authorization-server

[AbhishekDoshi26]

Summary

_shorebird#3031 merged on 2026-09-11, and auth.shorebird.dev now serves real RFC 8414 metadata (issuer, /login, /token, PKCE, the actual scopes: admin, preview_read, zap_preview_publish). Verified live before touching anything.

• Added an accurate pointer to it in auth.md's Protected resources section.
• Restored the oauth-authorization-server Link header rel, pointing at auth.shorebird.dev (not a copy on this domain).

Deliberately not done

• Not republishing a copy at docs.shorebird.dev/.well-known/oauth-authorization-server. isitagentready.com's oauth-discovery check only looks at the scanned domain's own well-known paths and would not pass without one, but that is exactly the mistake _shorebird's own review caught and fix: remove OAuth and OIDC metadata that describes endpoints we do not have #659 removed. RFC 8414 resolves the well-known path from the issuer, so a copy here would not be found by standards-based discovery and would silently drift if the real document changes. Chose accuracy over that one check's score.
• oauth-protected-resource: _shorebird#3043 is still open, and api.shorebird.dev/.well-known/oauth-protected-resource still 404s. Left untouched.
• MCP Server Card: confirmed shorebird_mcp_server is real and live now at mcp.shorebird.dev/mcp (401 on an unauthenticated request, matching its RFC 9728 design). It backs Shorebird Zap, a prototype documented only on a deliberately unlisted page (src/unlisted.ts) for a limited beta. Publishing a public Server Card would advertise a capability the product side has deliberately kept out of the sitemap, llms.txt, and search indexes.
• DNS-AID: unchanged, still needs DNS zone control this session does not have.

Other

• Confirmed no stale scope names (apps:read, etc, deleted in fix: remove OAuth and OIDC metadata that describes endpoints we do not have #659) remain anywhere in this repo.
• Cleaned up 6 pre-existing em-dashes in functions/_middleware.ts and one in auth.md while in both files.

Test plan

• npx tsc --noEmit -p functions/tsconfig.json passes
• npm run build passes, cspell and prettier clean
• Verified via wrangler pages dev: new Link header and auth.md content correct, full existing negotiation scenario suite still passes (the old /ci/view-logs/ test target from earlier sessions was removed in docs: remove CI sub-routes #685 since Shorebird CI is deprecated; retested against /getting-started/)

[AbhishekDoshi26]

Reviewed with fresh eyes: no correctness, cleanup, or convention issues found. The review independently curled the live auth.shorebird.dev endpoint to verify the new pointer and Link header rel match reality, and confirmed no stale scope references remain anywhere in the repo.