Tags: vmkteam/mcpurl

Request offline_access so tokens can refresh

- Append offline_access in resolveScopes for every discovery-driven
  branch, not just the OIDC fallback: any server whose Protected
  Resource Metadata advertises scopes_supported previously got a
  token with no refresh_token, forcing a browser login on every
  client restart
- Gate the append on the AS advertising offline_access in
  scopes_supported, so a strict server is never handed invalid_scope
- Fix Token.Scopes recording requested scopes instead of the ones the
  AS granted; they differ when the server silently drops scopes the
  client is not configured for, which made the stored token claim a
  refresh capability it did not have
- Share the "granted scope wins, else keep what we had" rule
  (RFC 6749 5.1) between the login and refresh paths
- Warn at login when the AS issues no refresh_token, naming the
  granted scope and both fixes; add Flow.Warnf mirroring Bridge.Warnf
  so it reaches the operator without -v
- Return owned memory from withOffline: the result outlives discovery
  inside a stored Token and must not alias the cache
- Replace hasS256 with slices.Contains, now that the file imports
  slices

Surface upstream failures instead of retrying

- Keep the bridge transparent: 429 and other upstream errors reach the
  client as -32603 with the HTTP status, no silent retries
- Log POST failures at warn level so operators see rate limits and 5xx
  in the MCP client log without -v
- Add a test pinning the no-retry contract for 429