#1245 fix(agents): address review on agent discovery surfaces

Summary

Follow-up to #1244 for the cubic review findings, which were left open when #1244 was merged.

• Remove the A2A Agent Card (/.well-known/agent-card.json, /.well-known/agent.json, homepage Link entry). Cubic is right: under the A2A spec (§5.1, §5.8), a custom binding is a different transport for A2A operations, and api.capgo.app/mcp only speaks MCP. A2A clients could discover the card and send requests the server can't handle. An A2A card should only come back with a real A2A endpoint or adapter.

• Shared well-known helpers: worker/well-known.ts holds the CORS headers and the OPTIONS/405 guard used by mcp.json, oauth-protected-resource and oauth-authorization-server. This fixes the drift where the OAuth metadata 405 was missing Cache-Control: no-store.

• Web Bot Auth secret hygiene: a malformed WEB_BOT_AUTH_PRIVATE_JWK logs only the error name, never the parse error (which can echo secret fragments).

• Web Bot Auth key compatibility: only kty/crv/x/d are passed to signerFromJWK, so keys exported by WebCrypto (alg: "Ed25519", which web-bot-auth rejects) work. I checked that the production key still loads with the same keyid.

• Tests for the signing path: the public key and fetch are injectable. New tests cover the directory signature (verifies for the requesting authority, fails for another), signedFetch headers verified with web-bot-auth's verify(), the unsigned fallback, and that no secret reaches the logs.

• OAuth metadata source: reads api.capgo.app/mcp/oauth/metadata first. Cap-go/capgo.app#3803 now returns 404 at its own well-known URL when the issuer is capgo.app (RFC 8414 §3.3). It falls back to the old well-known URL, so this PR and #3803 can deploy in either order.

Already fixed in #1244 before merge: the OAuth metadata issuer mismatch. The route now only serves metadata whose issuer is https://capgo.app (with Cap-go/capgo.app#3803).

Test plan

• bun test apps/web/test apps/web/src/worker: 257 pass
• bun run lint
• astro check: 0 errors

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}