fix: answer /.well-known OAuth discovery without a canonical redirect; smoke checks the real path

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

tests/Integration/mcp-smoke.sh

@@ -60,14 +60,16 @@ curl -s --max-time 20 -H "Host: $HOST" -H 'X-Forwarded-Proto: https' \
   || fail "authorization-server metadata missing CIMD flag"
 pass "RFC 8414 authorization-server metadata advertises CIMD"
 
-# ENVIRONMENT check (never fails): the real .well-known path, same Host/proto.
-WELLKNOWN=$(curl -s --max-time 20 -H "Host: $HOST" -H 'X-Forwarded-Proto: https' \
-  'http://localhost/.well-known/oauth-protected-resource')
-if echo "$WELLKNOWN" | grep -q '"resource"'; then
-  pass "/.well-known/ reachable"
-else
-  echo "WARN - /.well-known/ blocked by web server config (claude.ai discovery will fail; allow .well-known in nginx)"
-fi
+# The real .well-known path, same Host/proto, WITHOUT following redirects: clients use
+# the exact resource_metadata URL from the 401 header. Needs the web server to pass
+# /.well-known/ to WordPress (DDEV: .ddev/nginx/well-known.conf) and the plugin's
+# DiscoveryCanonical (no trailing-slash 301).
+for DOC in oauth-protected-resource oauth-authorization-server; do
+  CODE=$(curl -s --max-time 20 -o /dev/null -w '%{http_code}' -H "Host: $HOST" -H 'X-Forwarded-Proto: https' \
+    "http://localhost/.well-known/$DOC")
+  [ "$CODE" = "200" ] || fail "/.well-known/$DOC answered $CODE (web server blocks it or WordPress redirects)"
+done
+pass "/.well-known/ discovery documents answer directly (200, no redirect)"
 
 # 2. Unauthenticated request -> 401 with WWW-Authenticate
 UNAUTH=$(curl -s --max-time 20 -i -X POST "$ENDPOINT" -H 'Content-Type: application/json' -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}')