fix(tests): update token-validation tests to expect JSON-RPC error

Commit 2fa6fd8 intentionally changed invalid-token rejection from
HTTP 401 to JSON-RPC HTTP 200 to avoid triggering OAuth flow in
clients when OAuth is degraded; tests were not updated at that time.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: davidruzicka

src/testing/token-validation.test.ts

@@ -259,16 +259,17 @@ describeIfListen('Token Validation Integration', () => {
             clientInfo: { name: 'test', version: '1.0.0' },
           },
         })
-        .expect(401);
+        .expect(200);
 
       // Validation should have been called
       expect(validationCallCount).toBe(1);
       expect(lastValidationToken).toBe('invalid-token-xyz');
 
       // Should not create session
       expect(response.headers['mcp-session-id']).toBeUndefined();
-      expect(response.body.error).toBe('Unauthorized');
-      expect(response.body.message).toContain('Invalid or expired');
+      // JSON-RPC error response (HTTP 200 to avoid triggering OAuth flow in clients)
+      expect(response.body.error).toBeDefined();
+      expect(response.body.error.message).toContain('invalid or expired');
     });
 
     it('should reject expired token', async () => {
@@ -289,10 +290,12 @@ describeIfListen('Token Validation Integration', () => {
             clientInfo: { name: 'test', version: '1.0.0' },
           },
         })
-        .expect(401);
+        .expect(200);
 
       expect(validationCallCount).toBe(1);
-      expect(response.body.error).toBe('Unauthorized');
+      // JSON-RPC error response (HTTP 200 to avoid triggering OAuth flow in clients)
+      expect(response.body.error).toBeDefined();
+      expect(response.body.error.message).toContain('invalid or expired');
     });
   });
 
@@ -355,9 +358,11 @@ describeIfListen('Token Validation Integration', () => {
             clientInfo: { name: 'test', version: '1.0.0' },
           },
         })
-        .expect(401);
+        .expect(200);
 
-      expect(response.body.error).toBe('Unauthorized');
+      // JSON-RPC error response (HTTP 200 to avoid triggering OAuth flow in clients)
+      expect(response.body.error).toBeDefined();
+      expect(response.body.error.message).toContain('invalid or expired');
     });
   });