Spec §9: claude.ai custom connectors require OAuth (DCR) — bearer-only blocks them

Found at 2.2.0 deploy: the Connect flow attempts Dynamic Client Registration and
offers no custom-header option. Minimal single-user OAuth layer queued as 2.2.x
backlog next to the nightly vault backup. Claude Code / desktop / CoWork header
auth unaffected.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docs/MCP-SERVER-SPEC.md

@@ -337,8 +337,13 @@ that division of labor is permanent, not a v1 scope cut).
   `https://echomcp.alwisp.com/mcp` with the `Authorization: Bearer` header
   (project or user scope). No plugin-manifest coupling; the plugin does **not**
   register the server.
-- **claude.ai**: custom connector with the same URL + token — ECHO memory from
-  the browser/phone, a surface the plugin could never reach.
+- **claude.ai**: **blocked in v1 (found at 2.2.0 deploy)** — claude.ai custom
+  connectors run the MCP OAuth flow (Dynamic Client Registration against the
+  server) and offer no custom-header option, so a bearer-only server cannot
+  connect. Fix = a minimal single-user OAuth layer on echo-mcp (SDK auth
+  interface: DCR + one-time operator approval + token issuance) — **v2.2.x
+  backlog, alongside the nightly vault backup**. Token-in-URL workarounds are
+  rejected (credentials leak into logs).
 - **SKILL.md** gains: *"When the `echo_*` MCP tools are available, prefer them
   for every operation they cover; the `$ECHO` CLI recipes are the fallback for
   hosts without the connector or when the server is unreachable."* Procedures