Fix SSE test resource URL validation errors

Fixed 5 instances of hardcoded "https://resource.example.com" in OAuth
protected resource metadata mocks to use the actual resourceBaseUrl.href.
This resolves test failures where the auth validation was rejecting
requests because the resource URL in the metadata didn't match the
actual test server URL.

The failing tests were:
- attempts auth flow on 401 during SSE connection
- attempts auth flow on 401 during POST request
- refreshes expired token during SSE connection
- refreshes expired token during POST request
- redirects to authorization if refresh token flow fails

All SSE tests now pass (17/17).

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <[email protected]>

Author: ochafik

src/client/sse.test.ts

@@ -398,7 +398,7 @@ describe("SSEClientTransport", () => {
             'Content-Type': 'application/json',
           })
           .end(JSON.stringify({
-            resource: "https://resource.example.com",
+            resource: resourceBaseUrl.href,
             authorization_servers: [`${authBaseUrl}`],
           }));
           return;
@@ -450,7 +450,7 @@ describe("SSEClientTransport", () => {
                 'Content-Type': 'application/json',
               })
               .end(JSON.stringify({
-                resource: "https://resource.example.com",
+                resource: resourceBaseUrl.href,
                 authorization_servers: [`${authBaseUrl}`],
               }));
               return;
@@ -601,7 +601,7 @@ describe("SSEClientTransport", () => {
             'Content-Type': 'application/json',
           })
           .end(JSON.stringify({
-            resource: "https://resource.example.com",
+            resource: resourceBaseUrl.href,
             authorization_servers: [`${authBaseUrl}`],
           }));
           return;
@@ -723,7 +723,7 @@ describe("SSEClientTransport", () => {
             'Content-Type': 'application/json',
           })
           .end(JSON.stringify({
-            resource: "https://resource.example.com",
+            resource: resourceBaseUrl.href,
             authorization_servers: [`${authBaseUrl}`],
           }));
           return;
@@ -851,7 +851,7 @@ describe("SSEClientTransport", () => {
             'Content-Type': 'application/json',
           })
           .end(JSON.stringify({
-            resource: "https://resource.example.com",
+            resource: resourceBaseUrl.href,
             authorization_servers: [`${authBaseUrl}`],
           }));
           return;