Complete embedded AS surface: RFC 7592 management and introspection

[JAORMX]

Part of #5743 (Workstream B: 2025-11-25 compliance / auth polish).

Gap

Two completeness gaps in the embedded authorization server (pkg/authserver) — the core MCP OAuth surface (RFC 9728, 8707, 8414, 7591, 7636, CIMD, 8693) is solidly implemented:

1. RFC 7592 (dynamic client registration management): we return registration_access_token/registration_client_uri types client-side, but serve no GET/PUT/DELETE management endpoints for registered clients.
2. RFC 7662 (token introspection): fosite has the capability but no /introspect route is exposed and introspection_endpoint is never advertised in AS metadata.

Proposed work

• Serve RFC 7592 management endpoints for DCR-registered clients (or explicitly document non-support and stop returning management metadata).
• Expose and advertise the introspection endpoint.

Note: DCR is deprecated in favor of CIMD in the 2026-07-28 revision — keep the 7592 investment minimal accordingly.

Priority: Low.

[JAORMX]

Deferred to backlog — listed in epic #5743 under expected follow-ups; will be re-opened/re-filed when prioritized. Note: DCR is deprecated in MCP 2026-07-28, keep any RFC 7592 investment minimal.