The Cognito war stories: four ways it breaks an MCP server, and the fix for each

Amazon Cognito and the Model Context Protocol disagree about OAuth in four concrete places. Here is where each one bites and what got us past it.