Follow-up: RFC 8414 issuer normalization on the OAuth root fallback (trailing slash) + #4211 review LOWs #4345

Follow-up LOWs from the review of #4211 (CLEAR at c98eee2, Opus 5.5).

1. Trailing-slash issuer on the root fallback (oauth-issuer.ts:11-20). With no protected-resource metadata, the root fallback now rejects an authorization-server metadata issuer written as https://origin/ (Auth0's style) although that is the exact URL the SDK discovered. Before fix(mcp): validate OAuth metadata and bind credentials to issuers #4211 nothing compared issuers, so such servers worked. MCP 2026-07-28 requires the metadata anyway, so this is a narrow compatibility cost, not a security issue. Accept both origin and origin/ in that branch only (they name the same origin).
2. Refresh error names the same server twice (oauth-refresh.ts:96-103). When only the stored client registration belongs to another server and the grant's own stamp matches, the message reads "now uses authorization server X, but its saved sign-in was issued by X". Clearing the credentials is right; say that the registration was the mismatch.
3. Nit: 4194-oauth-client-issuer.test.ts:13 ("does not declare a redirect application type for a client without redirects") also passes on the pre-fix code; it guards against regression rather than proving the fix.

Acceptance: a root-fallback server whose metadata issuer has a trailing slash connects; the registration-mismatch message names what mismatched.