The /consumer mount served Lane B's Protected-Resource-Metadata under /consumer/,
but the /consumer/mcp 401 advertises it at the HOST ROOT
(/.well-known/oauth-protected-resource/consumer/mcp) per RFC 9728 — so an MCP client
(Claude) followed the 401 to the root, 404'd, and fell back to Lane A (Microsoft).
build_http_app now dispatches the root Lane-B well-known to the Lane-B app (full,
unstripped path); everything else stays Lane A. Verified live end-to-end: /consumer/mcp
401 → root PRM 200 → authorization_servers = the WorkOS AuthKit domain; Lane A intact.

Work-Item: Feature/f-identity-frontdoor


Work-Item: Story/s-aob-port-contract

Co-authored-by: Jefferson Barnabé <3090620+ruinosus@users.noreply.github.com>
Co-authored-by: dna-sdlc[bot] <302582850+dna-sdlc[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>