The oauth-provider plugin mounts /.well-known/oauth-authorization-server and /.well-known/openid-configuration endpoints under the base path (e.g., /api/auth/.well-known/openid-configuration).

Per RFC 8414 Section 3 and OpenID Connect Discovery 1.0 Section 4, these endpoints must be located at the origin root when the issuer has no path component:

"Authorization servers supporting metadata MUST make a JSON document containing metadata [...] available at a path formed by inserting a well-known URI string into the authorization server's issuer identifier between the host component and the path component, if any."
— RFC 8414 Section 3

"OpenID Providers supporting Discovery MUST make a JSON document available at the path formed by concatenating the string /.well-known/openid-configuration to the Issuer."
— OpenID Connect Discovery 1.0 Section 4

The current implementation uses SERVER_ONLY metadata and prints warnings asking developers to set up reverse-proxy rules manually.

Describe the solution you'd like

Add a publicEndpoints plugin feature that mounts endpoints at the origin root instead of under the base path.

This would require:

1. Add publicEndpoints field to the plugin type definition
2. Add a publicRouter that mounts at "/" instead of the base path
3. Migrate well-known endpoints from endpoints to publicEndpoints

// Current (mounted at /api/auth/.well-known/...)
endpoints: {
  getOpenIdConfig: createAuthEndpoint("/.well-known/openid-configuration", ...)
}

// Proposed (mounted at /.well-known/...)
publicEndpoints: {
  getOpenIdConfig: createAuthEndpoint("/.well-known/openid-configuration", ...)
}

Describe alternatives you've considered

1. Keep current approach - Developers manually configure nginx/proxy rules. Works but adds setup friction.

2. Configuration option - Add an option like mountWellKnownAtRoot: true (default false) to opt-in. Safest but requires explicit configuration.

Additional context

Affected endpoints:

• /.well-known/oauth-authorization-server (RFC 8414)
• /.well-known/openid-configuration (OpenID Connect Discovery)
• /.well-known/oauth-protected-resource (in mcp.ts)

References:

• RFC 8414 - OAuth 2.0 Authorization Server Metadata
• OpenID Connect Discovery 1.0
• RFC 5785 - Defining Well-Known URIs