Add OAuth 2.1 authorization with PKCE and audience-bound tokens to an Apps SDK MCP server so ChatGPT can link user accounts

Documented steps

1. Serve `GET /.well-known/oauth-protected-resource` per RFC 9728, returning `resource` (canonical HTTPS identifier), `authorization_servers`, `scopes_supported`, and optionally `resource_documentation`; alternatively advertise it via a `WWW-Authenticate` header on 401 responses.
2. Expose authorization-server metadata at `/.well-known/oauth-authorization-server` (RFC 8414) or `/.well-known/openid-configuration`, including `authorization_endpoint`, `token_endpoint`, `code_challenge_methods_supported` containing `S256`, and `registration_endpoint` if you support Dynamic Client Registration.
3. Support the authorization-code flow with PKCE using the S256 challenge method — this is the flow ChatGPT performs.
4. Choose a client registration method: Client ID Metadata Documents (set `client_id_metadata_document_supported` true, support token auth method `none` for public-client PKCE or `private_key_jwt` with keys at `/oauth/jwks.json`), or Dynamic Client Registration where ChatGPT calls `registration_endpoint` once per connector instance.
5. Make the authorization server copy the `resource` parameter into the issued access token, conventionally as the `aud` claim, so the token is minted specifically for your MCP server.
6. On every request validate signature and issuer (`iss`), `exp` and `nbf`, that `aud` matches your resource identifier, and that required scopes are present; on failure return 401 with a `WWW-Authenticate` challenge.
7. Declare per-tool auth with `securitySchemes` (`noauth` for anonymous, `oauth2` for scoped access) AND raise runtime `_meta["mcp/www_authenticate"]` errors — both are required for ChatGPT to render account linking.
8. Register the redirect URI `https://chatgpt.com/connector/oauth/{callback_id}` (the legacy `https://chatgpt.com/connector_platform_oauth_redirect` remains supported).
9. Official docs: https://developers.openai.com/apps-sdk/build/auth