…server example

… server (#663)

- Remove all console.log, console.warn, and console.error from src/client and src/server
- Add ESLint no-console rule for client and server directories (excluding tests)
- Keep console statements in test files, examples, and CLI tools as intended

Addresses feedback in PR #665

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <[email protected]>

feat: remove console statements from SDK code

…urce-validation2

[auth] adjust default validation for resource parameter in client flow, and server example

Previously the SSE connection would always default to the
`/.well-known/oauth-protected-resource` URI, ignoring the `resource_metadata`
portion of the `www-authenticate` returned in a 401.

Extract the metadata from the initial 401, so RS servers with
custom protected resource URIs (as in RFC9728, [section 3.1][1]))
continue to work as expected.

[1]: https://datatracker.ietf.org/doc/html/rfc9728#section-3.1

…enstart

fix(client/sse): extract protected resource from eventsource 401

1.13.1