refactor: make oauth discovery reactive

[DaleSeo]

Fixes #1048 at its root cause.

Motivation and Context

The POST probe, introduced in #960 to pass the client conformance suite, sends a synthetic JSON-RPC initialize request during discovery. Servers that accept it create sessions that are never cleaned up. Investigating the fix exposed a deeper structural issue.

• The MCP spec defines discovery through the 401 response and its WWW-Authenticate header on the client's real request. Well-known URIs are the fallback.
• Servers that return 404 or 405 for a session-less GET are still spec-compliant. In particular, the spec allows 405 for endpoints without SSE.
• The TypeScript and Python SDKs do not use a probe. Their auth layers react to the 401 from the application's real request, so they do not have this problem.

This PR fixes the underlying issue instead of patching the probe by removing initialize POST probe entirely.

How Has This Been Tested?

Added tests

Breaking Changes

None

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update

Checklist

• I have read the MCP Documentation
• My code follows the repository's style guidelines
• New and existing tests pass locally
• I have added appropriate error handling
• I have added or updated documentation as needed