fix(server-auth-legacy): make express a required peer; clarify OAuth subclass availability in migration docs

Author: felixweinberger

docs/migration-SKILL.md

@@ -193,6 +193,8 @@ Individual OAuth error classes replaced with single `OAuthError` class and `OAut
 
 Removed: `OAUTH_ERRORS` constant.
 
+For server-side Authorization-Server implementations, the v1 subclass hierarchy (and `OAUTH_ERRORS`) is still available from `@modelcontextprotocol/server-auth-legacy` (frozen v1 copy). For client-side error handling, use `OAuthError` + `OAuthErrorCode` as below.
+
 Update OAuth error handling:
 
 ```typescript

docs/migration.md

@@ -798,6 +798,8 @@ The following individual error classes have been removed in favor of `OAuthError
 
 The `OAUTH_ERRORS` constant has also been removed.
 
+> **Server-side Authorization-Server code:** the v1 subclass hierarchy (and `OAUTH_ERRORS`) is still exported from `@modelcontextprotocol/server-auth-legacy` (frozen v1 copy). Use that package if you implement an OAuth Authorization Server. For client-side error handling, use `OAuthError` + `OAuthErrorCode` as below.
+
 **Before (v1):**
 
 ```typescript

packages/server-auth-legacy/package.json

@@ -53,11 +53,6 @@
     "peerDependencies": {
         "express": "catalog:runtimeServerOnly"
     },
-    "peerDependenciesMeta": {
-        "express": {
-            "optional": true
-        }
-    },
     "devDependencies": {
         "@modelcontextprotocol/core": "workspace:^",
         "@modelcontextprotocol/tsconfig": "workspace:^",