docs(client): document DPoP client authentication

[LeonMAG]

Summary

Documents the client-side DPoP activation path introduced in #2629.

The OAuth guide shows how a provider reuses one asynchronous DpopSession and explains its lifetime, DPoP versus Bearer presentation, and the signing-key requirement when tokens survive a restart. The middleware guide clarifies that withOAuth already composes DPoP request signing and nonce handling.

Changes

• Add a type-checked OAuth-guide snippet that retains one session promise.
• Explain activation and key/token persistence alongside the existing provider example.
• Clarify the withOAuth / withDpop boundary.

Verification

On Node 24 with the repository's pnpm version:

• pnpm sync:snippets --check
• pnpm --filter @modelcontextprotocol/examples typecheck
• pnpm check:all, including the documentation build
• pnpm build:all
• node scripts/smoke-dist-types.mjs
• Confirmed that deliberate snippet drift fails the sync check, then restored it and verified the check passes.

pnpm test:all was also run. Unit and integration suites pass. The e2e suite reports two failures in protocol:timeout:max-total for SSE, plus two unhandled timeout errors. Running those SSE scenarios on unmodified main reproduces one failure while the other variant passes. This PR changes documentation and a typecheck-only companion; it does not change runtime code.

The companion is typecheck-only; this does not claim an end-to-end run against a real authorization server.

Related to #2629

[changeset-bot]

⚠️ No Changeset found

Latest commit: 5c91bcf

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[pkg-pr-new]

Open in StackBlitz

@modelcontextprotocol/client

npm i https://pkg.pr.new/@modelcontextprotocol/client@3006

@modelcontextprotocol/codemod

npm i https://pkg.pr.new/@modelcontextprotocol/codemod@3006

@modelcontextprotocol/core

npm i https://pkg.pr.new/@modelcontextprotocol/core@3006

@modelcontextprotocol/server

npm i https://pkg.pr.new/@modelcontextprotocol/server@3006

@modelcontextprotocol/server-legacy

npm i https://pkg.pr.new/@modelcontextprotocol/server-legacy@3006

@modelcontextprotocol/express

npm i https://pkg.pr.new/@modelcontextprotocol/express@3006

@modelcontextprotocol/fastify

npm i https://pkg.pr.new/@modelcontextprotocol/fastify@3006

@modelcontextprotocol/hono

npm i https://pkg.pr.new/@modelcontextprotocol/hono@3006

@modelcontextprotocol/node

npm i https://pkg.pr.new/@modelcontextprotocol/node@3006

commit: 5c91bcf