muster release v5.42.0

core_auth_status reads every server’s sign-in state, and issues the links that start the missing grants. A client that gets a person ready before the agent needs them (a chat front-end after its sign-in) needed one core_auth_login per server to learn a link, and auth://status named no link. The new read-only core tool answers the auth://status document for the caller; with auth_urls: true every server waiting for the person’s grant carries its sign-in link (auth_url), and a server whose grant the person already holds is connected and reported connected. Each entry of both now says how the person reaches the server (kind: grant, sso or none) and, for a grant, whom it belongs to (grant_scope: subject or session). (#1507)

A server that needs the person’s grant reports auth_required before its issuer is known. A pending-auth server rebuilt from its service’s own data carries no 401-time auth info until a login discovers it, and auth://status reported it disconnected with no auth_tool: a client listing what the person must connect left it out. An OAuth server that neither forwards nor exchanges the person’s token now reports auth_required with core_auth_login and, where the MCPServer pins one, its issuer. (#1507)