auth: scope MCP tokens by server name

[Paul (pwang347)]

Summary

• add an optional, exact serverName to authenticate requests for MCP-owned challenges
• require hosts to apply named tokens only to that MCP server, even when sibling servers share the same OAuth resource and scopes
• update the authentication specification, JSON schema, all generated client mirrors, and the security changelog fragment

Validation

• protocol type-check
• TypeScript protocol, generator, and changelog tests
• change-fragment validation
• generated schema and client diffs checked against the repository generator
• full npm test (local npm ci is blocked by an ENOTCONN registry error; CI should run the canonical dependency/toolchain matrix)

Compatibility

The field is optional. Existing provider-level authentication and older clients continue to key tokens by resource and scopes; clients resolving a specific MCP challenge can opt into server-scoped routing.