MCP OAuth source doesn't send `resource` parameter required by RFC 9728 (breaks notfair.co and other resource-bound MCP servers)

Problem

When connecting an MCP source that uses RFC 9728 OAuth Protected Resource Metadata (e.g. https://notfair.co/api/mcp/notfair), Craft Agents successfully completes an OAuth flow and stores a token — but the MCP server rejects it with:

{"error":"Missing or invalid NotFair OAuth token","oauth":{"protocol":"oauth_2_1","preferred_flow":"authorization_code_pkce","resource_metadata":"https://notfair.co/.well-known/oauth-protected-resource/api/mcp/notfair"}}

The token is rejected because it was issued without the resource parameter in the authorization request. Per RFC 8707 (Resource Indicators for OAuth 2.0) — which RFC 9728 depends on — the client must include resource=<mcp_server_url> in the authorization and token requests so the server issues a token scoped to that specific resource.

Steps to Reproduce

1. Create an MCP source pointing to https://notfair.co/api/mcp/notfair with authType: "oauth" (no explicit OAuth credentials — relying on auto-discovery)
2. Trigger source_oauth_trigger
3. Complete the OAuth consent flow
4. The source reports isAuthenticated: true but source_test fails with the error above
5. No MCP tools from this server appear in the session

Expected Behavior

The OAuth authorization request should include resource=https://notfair.co/api/mcp/notfair (the MCP server URL), so the issued token is properly scoped and accepted by the server.### Proposed FixWhen authType: "oauth" and no explicit OAuth credentials are provided, the OAuth client should:

1. Fetch /.well-known/oauth-protected-resource<path> to discover the authorization server
2. Include resource=<mcp_server_url> in both the authorization request and token exchange (per RFC 8707 §2)This is part of the MCP authorization spec (2025-03-26+) and will be required by an increasing number of MCP servers.

Environment

• Craft Agents desktop app
• MCP server: https://notfair.co/api/mcp/notfair