Fix malformed API token auth handling

[mattzcarey]

Summary

• Convert expected direct Cloudflare credential validation failures into structured OAuth resource responses instead of uncaught Worker exceptions.
• Use credential ownership prefixes as optimization hints before probing identity:
  • cfat_: only query /accounts and require exactly one account.
  • cfut_ and Wrangler OAuth cfoat_: query /user and /accounts in parallel and require user identity.
  • unprefixed/legacy credentials: retain response-based inference for backward compatibility.
• Treat the Cloudflare OAuth credential obtained during this server's authorization flow explicitly as user-owned.
• Map malformed-token 400 responses to 401 invalid_token and return RFC 9728 WWW-Authenticate metadata with no-store headers.
• Return identity-probe rate limits as structured 429 temporarily_unavailable responses and preserve upstream Retry-After (default 30 seconds).
• Never infer account-token ownership from a transient /user failure; any simultaneous 5xx continues to take precedence as 502.
• Add exported-worker, HTTP-router, call-count, Wrangler OAuth, and mixed-status regression coverage.

Root cause

The direct credential route inferred ownership entirely from /user and /accounts responses. Expected validation errors escaped as McpError, so malformed values could become Worker exception responses. It also sent both identity requests for account-owned credentials even though current account-token formats encode their owner.

The MCP OAuth token and the upstream Cloudflare credential are different layers: workers-oauth-provider validates its own token and restores the already-verified Cloudflare user context. Direct Cloudflare API and Wrangler OAuth credentials continue through the explicit credential-validation branch.

Validation

• pnpm check:deps
• pnpm check:turbo
• pnpm check:format
• pnpm test — 283 tests
• pnpm turbo deploy -- -e staging --dry-run — 17 Workers
• Local GraphQL Worker + current wrangler auth token --json OAuth credential — authenticated initialize 200
• Production GraphQL endpoint + current Wrangler OAuth credential — authenticated initialize 200