failed to handle OAuth callback (cloudfare-api)

Reproduced on codex-cli 0.144.1 (macOS) via Cloudflare's official agent setup flow (developers.cloudflare.com/agent-setup/prompt.md). Affects 4 of the 5 servers: cloudflare, cloudflare-bindings, cloudflare-builds, cloudflare-observability (all fail with this same error; cloudflare-docs is public and works).

Evidence: each host's .well-known/oauth-authorization-server publishes issuer: https://<host> and authorization_response_iss_parameter_supported: true, but the authorization redirect does not include the RFC 9207 iss parameter, so the required-issuer check fails with missing required issuer.

The AS advertises iss support but does not emit it — see also #31573. It would help if the client error named exactly which claim was missing, and Cloudflare likely needs to emit iss per its own metadata. Cross-filed upstream: https://github.com/cloudflare/mcp-server-cloudflare/issues (Cloudflare).