test: import Server from the public mcp.server surface; fix stale shim docstring

Use the public 'from mcp.server import Server' in tests/client/test_auth.py,
matching __all__ and the sibling test files, and reword the _FirstChallenge
docstring which still claimed the bearer middleware cannot emit scope= in its
challenge (no longer true since the scope attribute fix).

Author: claude

tests/client/test_auth.py

@@ -32,10 +32,10 @@
     validate_authorization_response_iss,
     validate_metadata_issuer,
 )
+from mcp.server import Server
 from mcp.server.auth.provider import AccessToken
 from mcp.server.auth.routes import build_metadata
 from mcp.server.auth.settings import AuthSettings, ClientRegistrationOptions, RevocationOptions
-from mcp.server.lowlevel.server import Server
 from mcp.shared.auth import (
     AuthorizationCodeResult,
     OAuthClientInformationFull,

tests/interaction/auth/_harness.py

@@ -278,9 +278,10 @@ class _FirstChallenge:
     """ASGI shim that answers the first request to a path with 401 + a given WWW-Authenticate.
 
     Subsequent requests pass through to the wrapped app. Used to make the initial 401 carry
-    parameters (such as `scope=`) that the SDK's own bearer middleware cannot be configured
-    to emit, so client behaviour driven by those parameters is reachable end to end. Reserve
-    this pattern for behaviour the real server cannot be made to produce.
+    a challenge shape the SDK's own bearer middleware cannot be configured to emit for the
+    scenario under test (e.g. a `scope` differing from the configured `required_scopes`), so
+    client behaviour driven by those parameters is reachable end to end. Reserve this pattern
+    for behaviour the real server cannot be made to produce.
     """
 
     app: ASGIApp