docs: add auth bullets to express README intro

Author: felixweinberger

packages/middleware/express/README.md

@@ -8,6 +8,8 @@ It does **not** implement MCP itself. Instead, it helps you:
 
 - create an Express app with sensible defaults for MCP servers
 - add DNS rebinding protection via Host header validation (recommended for localhost servers)
+- protect routes with `requireBearerAuth` (validates `Authorization: Bearer …` via your `OAuthTokenVerifier`)
+- serve OAuth Protected Resource Metadata (RFC 9728) via `mcpAuthMetadataRouter`
 
 ## Install