POST / or POST /mcp (Bearer) — JSON-RPC. GET /mcp (Bearer) — SSE stream. OAuth: /.well-known/oauth-protected-resource, /authorize, /token, /register. GET /healthz.