fix: honor mcp-oauth's enabled/observability filters, disable second unprotected MCP endpoint

- Default oauthEnabled to WPMedia\MCP\OAuth\Context::is_enabled() instead of
  duplicating its filter logic, so the deprecated rocket_mcp_oauth_server_enabled
  filter and the typed wpmedia_mcp_oauth_server_enabled filter are honored
  exactly as mcp-oauth itself defines them.
- register() now disables mcp-adapter's default server
  (mcp_adapter_create_default_server => false) so no second, unauthenticated
  MCP endpoint (plain HttpTransport, is_user_logged_in()) is exposed alongside
  our OAuth-protected one; mcp-oauth's own ServerRegistrar registers the
  shared meta-abilities itself once the default server is disabled.
- Pass WPMedia\MCP\OAuth\Context::observability_handler() instead of null so
  mcp-oauth's own observability filter keeps working for our server too.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7

tests/Unit/Server/ServerRegistrarTest.php

@@ -4,6 +4,7 @@ declare(strict_types=1);
 
 namespace LIT\MCP\Tests\Unit\Server;
 
+use Brain\Monkey\Filters;
 use Brain\Monkey\Functions;
 use LIT\MCP\Abilities\Ability;
 use LIT\MCP\Guides\InstructionsBuilder;
@@ -85,6 +86,34 @@ final class ServerRegistrarTest extends TestCase
         self::assertFalse($oauthChecked, 'createServer must bail out before touching the adapter');
     }
 
+    public function testRegisterDisablesAdapterDefaultServerAndHooksCreateServer(): void
+    {
+        $registrar = new ServerRegistrar($this->registry(), $this->instructions());
+
+        Functions\expect('add_filter')
+            ->once()
+            ->with('mcp_adapter_create_default_server', '__return_false');
+        Functions\expect('add_action')
+            ->once()
+            ->with('mcp_adapter_init', [$registrar, 'createServer'], 5);
+
+        $registrar->register();
+    }
+
+    public function testDefaultOauthEnabledDelegatesToMcpOauthContext(): void
+    {
+        // LIT\MCP\Server\ServerRegistrar::__construct() defaults to
+        // (new \WPMedia\MCP\OAuth\Context())->is_enabled() – exercise that real
+        // Context, only stubbing the filter it reads, to prove we track its notion
+        // of "enabled" (including the deprecated rocket_mcp_oauth_server_enabled
+        // filter Context::is_enabled() also seeds from) instead of duplicating it.
+        Filters\expectApplied('wpmedia_mcp_oauth_server_enabled')->once()->andReturn(false);
+
+        $registrar = new ServerRegistrar($this->registry(), $this->instructions());
+
+        self::assertNull($registrar->serverArguments());
+    }
+
     public function testUnhookOAuthDefaultServerRemovesOnlyTheMcpOauthCallback(): void
     {
         $oauthRegistrar = Mockery::mock(OAuthServerRegistrar::class);