I want MCP clients (like Claude Code) to authenticate to Context Forge Virtual Servers using OAuth 2.0 with browser-based IDP SSO, instead of pre-generated JWT bearer tokens.

I've reviewed the docs on [OAuth 2.0 Integration](https://ibm.github.io/mcp-context-forge/manage/oauth), [SSO](https://ibm.github.io/mcp-context-forge/manage/sso), and [DCR](https://ibm.github.io/mcp-context-forge/manage/dcr), but couldn't figure out how to configure this.
The OAuth docs cover gateway-to-backend auth, and SSO appears to be for Admin UI only.

Claude Code → Context Forge (401 + discovery) → Browser → IDP → Token → Context Forge

Per the [MCP Authorization spec](https://modelcontextprotocol.io/specification/2025-06-18/basic/authorization), this requires RFC 9728 Protected Resource Metadata (/.well-known/oauth-protected-resource).

Is this currently possible? If so, how?