Covers: - redirectUrl uses callbackPort when set, falls back to default 19876 - redirectUri takes precedence over callbackPort when both are set - clientMetadata includes scope when set in config - clientMetadata omits scope when not set (backward compat) - token_endpoint_auth_method based on clientSecret presence Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>