README lists well-known routes that don't exist and omits the real ones #264

The README's "Well-Known Endpoints" lists (in the authorization section and the route list near the end) name routes that don't exist and miss the ones that do:

• GET /.well-known/mcp-server ("protected") → 404.
• GET /health ("always public") → there is no such route; with authorization on it answers 401, because the pre-handler runs first.
• Not listed: /.well-known/oauth-protected-resource (and its /mcp variant), /.well-known/openid-configuration/mcp, /.well-known/mcp-resource-health.
• Everything under /.well-known/ is skipped by the auth pre-handler, so "protected" is wrong for any of them.

Suggested fix

List the real routes and say they are unauthenticated.

Found during the round-7 review of #170; also on main.

🤖 Generated with Claude Code