Feat
- auth: accept CIMD client_ids and emit RFC 9207 iss (#1470)
Fix
- auth: reject percent-encoded dot segments in a CIMD client_id
- auth: close CIMD NAT64 SSRF gap and rate-limit document fetches
- webdav: use snake_case ToolAnnotations hints on the tag tools
Refactor
- auth: let a registered client win over CIMD resolution