[Deprecated-3][CONTROL-PLANE] DCR → Client ID Metadata Documents

[Lang-Akshay]

Part of #5677

Scope

Implement this in the Python ContextForge control plane (IBM/mcp-context-forge). The control plane owns OAuth/OIDC client registration, authorization routes, credential persistence, and compatibility fallbacks.

No Rust dataplane implementation is required. The dataplane consumes authenticated requests and must not become an IAM or OAuth client-registration service.

Spec link: https://modelcontextprotocol.io/specification/2026-07-28/changelog
Comprised of: Deprecated change 4 (deprecate OAuth 2.0 Dynamic Client Registration, RFC 7591 — spec PR modelcontextprotocol/modelcontextprotocol#2858).
Coordinates with: #5684 (application_type still applies on the DCR fallback path).

What the spec says

• The OAuth 2.0 Dynamic Client Registration Protocol (RFC 7591) is deprecated as a client registration mechanism in favor of Client ID Metadata Documents (CIMD).
• DCR remains available for backward compatibility with authorization servers that do not support Client ID Metadata Documents.

Control-plane work

• Implement CIMD-based client registration as the preferred Python control-plane path.
• Publish the control plane's client metadata document at a stable, documented HTTPS URL.
• Detect authorization-server CIMD support and fall back to DCR only when CIMD is unsupported.
• Keep the [Minor-1] OAuth hardening #5684 application_type behavior on the DCR fallback path.
• Store and retrieve registration metadata through the existing control-plane auth/credential services.
• Emit a safe deprecation notice when DCR fallback is used; do not log client secrets or tokens.
• Update control-plane configuration, API documentation, and OAuth integration tests.

Acceptance criteria

• CIMD registration works through the Python control-plane authentication flow against a CIMD-capable authorization server.
• The published client metadata document is stable, valid, and covered by tests.
• Non-CIMD authorization servers use the existing DCR fallback with application_type and a safe deprecation notice.
• Credentials remain issuer-bound and are persisted only through control-plane auth services.
• No Rust dataplane OAuth registration, credential storage, or IAM behavior is introduced.

Out of scope

• Rust dataplane changes.
• MCP transport/session compatibility work unrelated to OAuth client registration.