Fix/simple auth example

[nikodemas]

Fixes #2826 .

Motivation and Context

Fixes an error in the simple-auth example:

• Fix server_url link
• Fix the TODO related to the type hint with revoke_token method

How Has This Been Tested?

In addition to the tests, type checking and linting provided in the repo, I have tried to recreate the issue described in #2826 and it is now working fine.

Breaking Changes

No.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update

Checklist

• I have read the MCP Documentation
• My code follows the repository's style guidelines
• New and existing tests pass locally
• I have added appropriate error handling
• I have added or updated documentation as needed

Additional context

[STiFLeR7]

Reproduced #2826 end-to-end against current `upstream/main` and verified this fix resolves it.

Before the fix, running the exact repro from #2826 (auth server on :9000, resource server on :8001, then the auth client with `MCP_TRANSPORT_TYPE=streamable-http`) fails during the OAuth flow with:
```
mcp.client.auth.exceptions.OAuthFlowError: Protected resource http://localhost:8001/mcp does not match expected http://localhost:8001
```
This confirms the root cause the reporter identified: `ResourceServerSettings.server_url` defaulted to `http://localhost:8001/mcp\`, which becomes the RFC 9728 protected-resource identifier advertised in the `WWW-Authenticate`/PRM response, but the client's `_validate_resource_match` computes its expected resource from the request's origin (no path), so the two never match and every auth attempt fails — not a raw connection failure as the original traceback suggested, but a resource-mismatch rejection one layer up in the auth flow.

After applying this PR's diff to the same checkout: the resource server now logs `MCP Resource Server running on http://localhost:8001/\` (no `/mcp`), and the client completes the full OAuth flow (`resource=http%3A%2F%2Flocalhost%3A8001%2F` in the `/authorize` request now matches) and reaches `✨ Session initialization complete!` / `✅ Connected to MCP server`.

Also checked the second half of the diff (`revoke_token` signature fix in `simple_auth_provider.py`): the base `OAuthAuthorizationServerProvider.revoke_token` protocol in `src/mcp/server/auth/provider.py` is `async def revoke_token(self, token: AccessTokenT | RefreshTokenT) -> None`, so the old override (`token: str, token_type_hint: str | None = None`) was indeed a real signature mismatch, not just a stylistic TODO — this PR's `token: AccessToken | RefreshToken` + `token.token` lookup now matches the protocol it implements.

Both fixes are small, correct, and directly resolve #2826 — no regressions spotted in the surrounding code.

[maxisbey]

Thanks for the PR, and sorry it sat here without a proper review.

We're closing most of the open PR backlog. v2 is out and changed a lot of the SDK, so many older PRs no longer apply as written, and we're a small team that realistically doesn't have the capacity to work through the rest.

If this still matters to you on v2, the most useful thing you can do is open an issue (or comment on the existing one) with your use case and a repro. Hearing why it matters to you is what we use to decide what to prioritise.

_{AI Disclaimer}