pub const BEARER_ONLY_ROUTER_FORBIDDEN_PATHS: &[(&str, &str)];Expand description
Paths that must NOT be mounted by bearer_only_router — verified
by the snapshot test. Headless MCP clients have no browser to complete a
native-app OAuth flow with, so /native/callback//native/poll belong
here alongside the browser-only/DCR-only endpoints.