[Client] Inject Bearer token into HttpTransport requests + handle 401 re-auth

[soyuka]

Context

Once an access token is acquired (via any OAuth grant), every outbound JSON-RPC request on HttpTransport must carry Authorization: Bearer <token>. On a 401 Unauthorized mid-session, the transport must trigger a re-auth attempt and retry the failed request exactly once.

Scope

• src/Client/Transport/HttpTransport.php:
  • Read current token from TokenStorageInterface keyed by endpoint URL.
  • Add Authorization: Bearer <token> header on send() when a token is present.
  • On 401, parse WWW-Authenticate header, invoke auth coordinator, retry once.
• Introduce Mcp\Client\Auth\AuthCoordinator to orchestrate discovery → registration → token acquisition. (Implementation details land in dependent issues.)

Conformance scenarios unblocked

All auth/* scenarios depend on this wiring.

Dependencies

Blocked by: #315 (TokenStorageInterface).

Acceptance

• Unit tests for header injection + 401 retry behavior.
• Documented extension point for AuthCoordinator.

cc @soyuka