feat(auth): bind DCR client credentials to issuing authorization server (SEP-2352)

[alexhancock]

Motivation and Context

Per modelcontextprotocol/modelcontextprotocol#2352 clients SHOULD maintain separate registration state per auth server and MUST NOT assume cross-AS credential validity

How Has This Been Tested?

Conformance tests

cargo build -p mcp-conformance
npx -y @modelcontextprotocol/conformance@0.2.0-alpha.9 client --command ./target/debug/conformance-client --scenario auth/authorization-server-migration -o results

Breaking Changes

None. StoredCredentials is #[non_exhaustive] and has a new constructor

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update

Checklist

• I have read the MCP Documentation
• My code follows the repository's style guidelines
• New and existing tests pass locally
• I have added appropriate error handling
• I have added or updated documentation as needed

Additional context

Closes#879

[DaleSeo]

We now stamp issuer: self.metadata_issuer() here, but nothing reads it back. After a migration, what stops a static pre-registered credential from being silently sent to the new AS, the case where SEP-2352 says clients "SHOULD surface an error"?

[alexhancock]

good catch. initialize_from_store now returns an AuthorizationServerMismatch error on issuer change

[alexhancock]

I applied your suggestion @DaleSeo but had to squash to satisfy commitlint. Can you re-stamp? TY!