5.3.16

A connector registered itself and then stopped, without ever opening a browser.

The registration arrived and the client row was written. The authorize endpoint
was never called — which is what a client does when it has read the discovery
document and decided not to trust it.

RFC 8414 says the issuer must be the identifier the metadata was requested for.
With the path inserted, that is the site plus the resource's own path:

fetched   https://example.com/.well-known/oauth-authorization-server/wp-json/mcp/niranzwp
issuer    https://example.com/wp-json/mcp/niranzwp

This was returning the bare site at both URLs. A client that checks — and every
current connector checks — throws the document away, quietly, before it has
anywhere to send anyone.

The issuer now matches whichever URL was used, and the protected resource names
its authorization server the same way, so the two agree however a client got
there.