[sergeyfast]

• Add RFC 7591 dynamic client registration: without a configured clientID mcpurl registers a public client (PKCE, no secret) for its loopback redirect URI, so servers that offer DCR need no hand-made client and no --client-id; a configured clientID still wins
• Keep registrations in ~/.config/mcpurl/clients, keyed by endpoint and redirect URI: the callback port is part of what the server registered, and config.toml stays untouched, so bare-URL runs work too
• Register once across concurrent processes (Claude Desktop + Cursor) under a file lock that re-reads the store
• Drop the registration and its token and register anew with one browser login when refresh answers invalid_client or discovery finds another authorization server
• Follow a registration another process replaced: a second bridge waiting on the same token lock picks up the new client instead of opening a browser on the dead one
• Refuse confidential clients, foreign redirect_uris and servers without a registration endpoint with an actionable error, the server's own error text included
• Let logout work without a clientID and drop the registration too, an unreadable one included; uninstall and logout --all clean registrations up, show prints them
• Point the login timeout at mcpurl logout when the browser reports an unknown client: a server that forgot the client fails its authorization page, out of mcpurl's sight
• Add tests for registration and reuse, the two-process race, re-registration (also seen from a second bridge), a foreign issuer, every refused and lenient registration answer, a static client's invalid_client, unreadable registrations, and show / logout / logout --all / uninstall
• Update README for setups without --client-id
• Require Go 1.26.9 to clear stdlib advisories (net/http, net/textproto, crypto/tls) that failed the security job