* docs: document DCR redirect-URI step for MCP behind Cloudflare Access
Enabling Managed OAuth alone leaves MCP clients unable to finish Dynamic
Client Registration when their redirect URI isn't allowlisted, so they log
in but expose no tools (issue #47). Document allowing localhost/loopback
clients and HTTPS web-connector redirect URIs, linking Cloudflare's docs.
* docs: fold DCR redirect-URI guidance into the setup steps
Move the Dynamic Client Registration guidance from a standalone paragraph
into step 6 of the numbered list, with sub-bullets for localhost/web
redirect URIs and a footnote explaining why (logs in but no tools).
* docs: replace DCR footnote with a sub-bullet
da06190e5f