OAuth protected-resource metadata (delegated to better-auth)

Returns the RFC 9728 protected-resource metadata for the Charming API origin. Read by clients that treat the origin as the protected resource; a client asking about one MCP surface reads the path-scoped document under this path instead, which is what that surface names in its 401 WWW-Authenticate header.

curl -X GET 'https://charm.ing/.well-known/oauth-protected-resource' \
  -H 'Accept: application/json'

const response = await fetch("https://charm.ing/.well-known/oauth-protected-resource", {
  method: "GET",
  headers: {
    "Accept": "application/json"
  }
});

import requests

response = requests.get(
    "https://charm.ing/.well-known/oauth-protected-resource",
    headers={
        "Accept": "application/json"
    },
)

{}