fix: split MCP discovery check to bypass local nginx dotfile block

Local DDEV nginx denies all dotfile paths (including /.well-known/),
blocking check 1 before it reaches WordPress -- an environment issue,
not a WP-LIT-MCP/mcp-oauth defect. Check 1 now hits mcp-oauth's own
discovery rewrite target (index.php?mcp_oauth_discovery=...) with a
Host header derived from `wp option get home` as a HARD check, and
separately probes the real /.well-known/ path as a non-failing
ENVIRONMENT check that warns if the web server blocks it. Also adds
--max-time 20 to every curl call so the script can never hang.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7

tests/Integration/mcp-smoke.sh

@@ -43,7 +43,7 @@ trap cleanup EXIT
 mcp() { # $1 token, $2 json body, $3 session id (optional) -> prints headers+body
   local session_header=()
   [ -n "${3:-}" ] && session_header=(-H "Mcp-Session-Id: $3")
-  curl -s -i -X POST "$ENDPOINT" \
+  curl -s --max-time 20 -i -X POST "$ENDPOINT" \
     -H "Authorization: Bearer $1" \
     -H 'Content-Type: application/json' \
     -H 'Accept: application/json, text/event-stream' \
@@ -51,15 +51,46 @@ mcp() { # $1 token, $2 json body, $3 session id (optional) -> prints headers+bod
 }
 
 # 1. Discovery documents
-curl -s http://localhost/.well-known/oauth-protected-resource | grep -q '"resource"' \
+#
+# The local DDEV nginx config denies all dotfile paths (`location ~ /\. { deny
+# all; }`, in the parent project's .ddev/nginx_full/nginx-site.conf, outside
+# this plugin), which blocks the real `/.well-known/...` paths before the
+# request ever reaches WordPress. That's an environment/deployment concern,
+# not a WP-LIT-MCP or mcp-oauth defect, so it must not fail this test.
+#
+# The HARD checks below instead hit mcp-oauth's own rewrite target directly
+# (index.php?mcp_oauth_discovery=...) via a request whose Host matches the
+# site's home URL (WordPress issues a 301 to the canonical host otherwise),
+# proving the discovery documents themselves are correct. The ENVIRONMENT
+# check further down separately probes the real `/.well-known/` path and only
+# warns, never fails, so a misconfigured web server doesn't block this suite
+# while still surfacing the risk (real MCP clients like claude.ai use the
+# real path, not the rewrite target).
+HOST=$(wp option get home | sed -E 's#^[a-zA-Z]+://##')
+
+curl -s --max-time 20 -H "Host: $HOST" -H 'X-Forwarded-Proto: https' \
+    'http://localhost/?mcp_oauth_discovery=protected-resource' \
+  | grep -q '"resource"' \
   || fail "protected-resource metadata missing"
 pass "RFC 9728 protected-resource metadata served"
-curl -s http://localhost/.well-known/oauth-authorization-server | grep -q 'client_id_metadata_document_supported' \
+
+curl -s --max-time 20 -H "Host: $HOST" -H 'X-Forwarded-Proto: https' \
+    'http://localhost/?mcp_oauth_discovery=authorization-server' \
+  | grep -q 'client_id_metadata_document_supported' \
   || fail "authorization-server metadata missing CIMD flag"
 pass "RFC 8414 authorization-server metadata advertises CIMD"
 
+# ENVIRONMENT check (never fails): the real .well-known path, same Host/proto.
+WELLKNOWN=$(curl -s --max-time 20 -H "Host: $HOST" -H 'X-Forwarded-Proto: https' \
+  'http://localhost/.well-known/oauth-protected-resource')
+if echo "$WELLKNOWN" | grep -q '"resource"'; then
+  pass "/.well-known/ reachable"
+else
+  echo "WARN - /.well-known/ blocked by web server config (claude.ai discovery will fail; allow .well-known in nginx)"
+fi
+
 # 2. Unauthenticated request -> 401 with WWW-Authenticate
-UNAUTH=$(curl -s -i -X POST "$ENDPOINT" -H 'Content-Type: application/json' -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}')
+UNAUTH=$(curl -s --max-time 20 -i -X POST "$ENDPOINT" -H 'Content-Type: application/json' -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}')
 echo "$UNAUTH" | head -1 | grep -q ' 401' || fail "expected 401 without token"
 echo "$UNAUTH" | grep -qi '^www-authenticate: Bearer' || fail "missing WWW-Authenticate header"
 pass "401 + WWW-Authenticate without token"
@@ -84,7 +115,7 @@ echo "$CALL" | grep -q 'the-events-calendar' || fail "site-status lacks componen
 pass "tools/call lit-site-status works"
 
 # 4. Token must not authenticate other REST routes (mcp-oauth issue #62)
-ME=$(curl -s -o /dev/null -w '%{http_code}' http://localhost/wp-json/wp/v2/users/me -H "Authorization: Bearer $TOKEN")
+ME=$(curl -s --max-time 20 -o /dev/null -w '%{http_code}' http://localhost/wp-json/wp/v2/users/me -H "Authorization: Bearer $TOKEN")
 [ "$ME" = "401" ] || fail "MCP token authenticates /wp/v2/users/me (HTTP $ME) – scope filter needed"
 pass "MCP token is rejected on /wp/v2/users/me"