The initial OAuth token was issued without API scopes because mcpx
didn't read the protected resource metadata. Now mcpx:

1. Fetches /.well-known/oauth-protected-resource to discover required scopes
2. Passes scopes during client registration
3. Includes scope parameter in the authorization URL

This fixes the "Invalid API key" error on first token for PostHog
and other MCP servers that require specific scopes.