[13.x] Document rate limiting MCP OAuth routes
Merged
PU
13d ago+21+21+01234567890123456789-0-0-0123456789
Documents that the dynamic client registration route registered by Mcp::oauthRoutes is intentionally public (per RFC 7591 and the MCP specification), and shows how applications can rate-limit these routes with the throttle middleware or disable registration with Mcp::oauthRoutes(registration: false).
Rate limiting is left to the application, since a default limit could block legitimate users. Context: laravel/mcp#321.