RFC 9728 protected-resource metadata: names the OAuth server that guards this MCP resource. Clients fetch this (via the `resource_metadata` pointer in our 401 challenge) to learn which authorization server to use.

Request

curl --request GET \
  --url https://api.brainbaselabs.com/.well-known/oauth-protected-resource