1. Remove hardcoded scope='mcp:tools' from client metadata.
Providers like Granola reject this scope at the authorize endpoint
(invalid_scope). Let the MCP SDK derive scope from server metadata
instead, falling back to the auth server's scopes_supported.
2. Swallow xdg-open ENOENT on headless Linux servers.
On VPS/CI environments without a desktop, spawning xdg-open throws
an unhandled error event that crashes the process before the OAuth
callback server can receive the redirect.
3. Clear stale client registration when dynamic callback port changes.
With dynamic ports (the default), each run picks a different port.
If a previous client registration is cached with a different
redirect_uri, the auth server rejects subsequent requests with
invalid_redirect_uri. Now detects the mismatch and re-registers.
Fixes#67
31142e03a6