fix(oauth): publish bare-origin resource per OpenAI Apps SDK docs

[jfassio]

Summary

OpenAI's Apps SDK auth docs are explicit:

"`resource`: the canonical HTTPS identifier for your MCP server. ChatGPT sends this exact value as the `resource` query parameter during OAuth."

Their example shows the bare origin:

```json
{ "resource": "https://your-mcp.example.com", ... }
```

We've been publishing `${origin}/mcp` (e.g. `https://mcp.tako.com/mcp\`). RFC 9728 allows either form, but ChatGPT's App Review classifier appears to require the bare-origin shape. Every metadata-shape variant we tried in PR #72 was rejected with the same generic `"unsupported OAuth config type"` while our metadata otherwise matched every published spec. The bare-origin `resource` is the only material difference between our doc and the documented OpenAI example.

Change

`workers/src/oauth/handlers.ts` — one line:

```diff

• resource: `${origin}/mcp`,

• resource: origin,
  ```

Notes

• Per RFC 9728 either form is spec-conformant; this just narrows our value to match what the OpenAI classifier expects.
• No `/mcp` route changes — the actual MCP endpoint is still served at `POST /mcp`. The `resource` field is metadata, not routing.
• Independent of PR feat(oauth): RFC 8707 resource indicator support #73 (RFC 8707 resource-indicator validation). PR feat(oauth): RFC 8707 resource indicator support #73's validator currently expects `${origin}/mcp` as the canonical resource value; if this PR lands first, PR feat(oauth): RFC 8707 resource indicator support #73 will need its validator updated to accept the bare origin instead. Filing as a separate small PR so it can deploy independently and quickly.

Test plan

• `npm run typecheck` clean
• `npm test` — 220/220 passing (test for protected-resource metadata updated to expect bare origin)
• Deploy to staging, then retry the App Review wizard publish flow
• Re-test Claude.ai connect (Claude.ai uses the `resource` value from protected-resource metadata; should be unaffected since we still serve a valid resource URL)

🤖 Generated with Claude Code