fix: answer /.well-known OAuth discovery without a canonical redirect; smoke checks the real path

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

src/Plugin.php

@@ -29,6 +29,7 @@ use LIT\MCP\Integrations\WordPress\Schema\ContentSchema;
 use LIT\MCP\Integrations\WordPress\Schema\RegisteredMetaSource;
 use LIT\MCP\Integrations\WordPress\Schema\SampledMetaSource;
 use LIT\MCP\Integrations\WordPress\WordPressIntegration;
+use LIT\MCP\Server\DiscoveryCanonical;
 use LIT\MCP\Server\RequestContext;
 use LIT\MCP\Server\ServerRegistrar;
 use LIT\MCP\Server\VisibilityFilter;
@@ -57,6 +58,7 @@ final class Plugin
         $access->register();
         (new RequestContext())->register();
         (new VisibilityFilter())->register();
+        (new DiscoveryCanonical())->register();
 
         $limits = new Limits();
         $changeLog = new ChangeLog();

src/Server/DiscoveryCanonical.php

@@ -0,0 +1,29 @@
+<?php
+
+declare(strict_types=1);
+
+namespace LIT\MCP\Server;
+
+/**
+ * Keeps WordPress' canonical redirect away from mcp-oauth's two discovery documents.
+ * With a pretty permalink structure ending in "/", WordPress 301-redirects
+ * /.well-known/oauth-protected-resource to a trailing-slash URL; the resource_metadata
+ * URL in the 401 header and RFC 8414/9728 clients use the exact path, so it must answer
+ * directly instead of relying on every client following redirects.
+ */
+final class DiscoveryCanonical
+{
+    private const PATH = '#/\.well-known/oauth-(?:protected-resource|authorization-server)/?$#D';
+
+    public function register(): void
+    {
+        add_filter('redirect_canonical', [$this, 'filter'], 10, 2);
+    }
+
+    public function filter(mixed $redirect, mixed $requested): mixed
+    {
+        $path = is_string($requested) ? (string) wp_parse_url($requested, PHP_URL_PATH) : '';
+
+        return preg_match(self::PATH, $path) === 1 ? false : $redirect;
+    }
+}