fix(auth): forward user-agent to oauth flow requests

[mrutunjay-kinagi]

Summary

• forward caller User-Agent from the original MCP request into OAuth flow sub-requests
• apply forwarding to PRM discovery, auth server metadata discovery, dynamic client registration, and token exchange/refresh requests
• add regression coverage ensuring forwarded User-Agent is preserved throughout the 401 -> OAuth handshake path

Why

Fixes missing User-Agent propagation in Streamable HTTP auth flow requests, which can break environments that enforce WAF rules requiring User-Agent headers.

Closes #1664

Validation

• pytest -q tests/client/test_auth.py -k "forwards_user_agent or auth_flow_with_no_tokens"
• ruff check src/mcp/client/auth/oauth2.py tests/client/test_auth.py
• ruff format --check src/mcp/client/auth/oauth2.py tests/client/test_auth.py

[mrutunjay-kinagi]

Thanks for sharing this run.

I pushed a follow-up commit (40f173f) to address the failure pattern shown there:

• removed a stale # pragma: no cover on tests/client/test_auth.py:48 that is now exercised by the new auth-flow test.

That was what caused Linux matrix failures in that run under strict-no-cover.

[mrutunjay-kinagi]

Follow-up commit 40f173f addressed the previous Linux strict-no-cover failure, and all checks are now green.

@Kludex Ready for review Thanks!

[mrutunjay-kinagi]

Follow-up on CI run https://github.com/modelcontextprotocol/python-sdk/actions/runs/22261553587 (job 64400559254):\n\n- Only checks / test (3.13, locked, windows-latest) failed.\n- Failure appears unrelated/flaky (not in auth-flow code path):\n - tests/client/test_stdio.py::TestChildProcessCleanup::test_early_parent_exit (AssertionError: Child should be writing)\n - tests/client/transports/test_memory.py::test_raise_exceptions\n- Workflow conclusion is success and all-green passed, but this stale failed check remains visible.\n\nI don't have permission to rerun upstream Actions jobs from CLI. If needed, a maintainer rerun of the failed job should clear this.

[mrutunjay-kinagi]

@maxisbey : Please take a look at the PR let me know of what do you think ?