AdCP sales training sandbox: OAuth authentication

Connect to https://test-agent.adcontextprotocol.org/sales/mcp. Follow its unauthenticated 401 WWW-Authenticate
challenge to https://test-agent.adcontextprotocol.org/.well-known/oauth-protected-resource/sales/mcp. Use the advertised authorization server
https://clean-gradient-46.authkit.app, PKCE, and the exact resource indicator https://test-agent.adcontextprotocol.org/sales/mcp.
Request openid profile email offline_access. Use a public OAuth client registered
with that server, or dynamic client registration when supported by the server.

Sign in with an AgenticAdvertising.org account and select an organization where
you have an active owner, admin, or member role. A paid subscription is not
required. General callers share an organization-scoped training sandbox.
Private canary owners/admins with a provisioned local grant retain their private
buyer identity; ordinary canary members use a separate sandbox.

Live GCS reporting under /sales/reporting is restricted to the private canary's
provisioned owners/admins. Denied OAuth calls return 403 BUYER_ACCESS_DENIED with
error_description and WWW-Authenticate: Bearer error="insufficient_scope".
Show the description instead of retrying sign-in or reporting discovery failure.

Without organization access, use the shared public bearer test token documented
at https://docs.adcontextprotocol.org/docs/quickstart#setup. Other specialism
endpoints accept bearer test tokens or organization API keys.