fix(mcp-auth): repoint IAS public-PKCE OAuth to new tenant alzmza7li (#2550)

[jung-thomas]

What

Repoints the MCP public-PKCE OAuth (IAS) discovery + client from the retired tenant atxgsg7zi to the fresh SAP Universal ID tenant alzmza7li. This finishes the OAuth-mechanics work merged in #2544/#2545, which was blocked (#2551) on the old tenant's broken SAP-ID SAML trust. The subaccount trust is already cut over to alzmza7li (sap.custom origin = "Tutorial System (SAP Universal ID)", direct Universal ID); only the MCP service instance + approuter discovery env lagged behind.

Changes

• deploy/dev.mtaext — approuter XSUAA_MCP_URL: atxgsg7zi → alzmza7li.accounts.ondemand.com. This is the issuer mcp-remote reads from .well-known/oauth-authorization-server; it still served the dead tenant (verified live via cf env).
• Recreated tutorials-identity CF instance on alzmza7li (out-of-band, as the existing-service it's adopted as). Broker minted a fresh secretless public client 02782268-9593-409a-8481-701bfa44ebc7; credential-type:NONE key verified NO clientsecret / NO cert. Loopback-only redirect-uris (IAS rejects the carried-over *.cfapps.* double-wildcard + vscode:// scheme; public-PKCE MCP only needs http://localhost:* / 127.0.0.1:* callbacks).
• docs/end-users/mcp-quickstart.md — pinned dev client_id → the new UUID.
• mta-mcp.yaml + test/unit/well-known-oauth.test.js — sync comments / IAS fixture to the new client + tenant.

Deploy state (DEV)

• tutorials-mcp MTA already redeployed → tutorials-srv-mcp rebound to the recreated tutorials-identity (bind confirmed).
• Main-MTA approuter redeploy (ships the new XSUAA_MCP_URL) runs from fresh DEV after this merges — the deploy guard requires HEAD == origin/DEV.

Verification (after merge + deploy)

1. .well-known/oauth-authorization-server advertises alzmza7li authorize/token endpoints, openid scope, none auth method.
2. Real mcp-remote login as I809764 completes WITHOUT the 400 that blocked IAS tenant reset — recreate shared PROD/DEV trust safely (unblocks #2550) #2551.
3. Authenticated MCP tool call returns the logged-in user's data (T2b resolveUserSapId IAS-claim branch is a follow-up — needs a real federated token to map the I-number claim; deferred to a subsequent PR).
4. XSUAA fallback + production login unaffected (different trust path).

Refs #2550, #2551.

🤖 Generated with Claude Code