When discoverAuthorizationServerMetadata() returns undefined (AS metadata endpoint returns 4xx or is unreachable), the SDK falls back to constructing authorization URLs using root-path defaults:

authorizationUrl = new URL('/authorize', authorizationServerUrl);

The problem: new URL('/authorize', 'https://example.com/admin') silently resolves to https://example.com/authorize — the /admin subpath is completely lost. The actual correct endpoint https://example.com/admin/oauth/authorize is never reached, and no error is thrown.

Reproduction

1. PRM returns authorization_servers: ["https://example.com/admin"]
2. AS metadata at https://example.com/.well-known/oauth-authorization-server/admin returns 404
3. SDK constructs new URL('/authorize', 'https://example.com/admin') → https://example.com/authorize
4. User is silently redirected to a nonexistent endpoint

Fix

Added a guard at all three fallback locations (/authorize, /token, /register):

} else {
    if (authorizationServerUrl.pathname !== '/') {
        throw new Error(
            `AS metadata discovery failed for '${authorizationServerUrl.href}'. ` +
            `Cannot safely construct '/authorize' — the server URL has a non-root path. ` +
            `Ensure the AS metadata endpoint is reachable at ` +
            `'${authorizationServerUrl.origin}/.well-known/oauth-authorization-server${authorizationServerUrl.pathname}'`
        );
    }
    authorizationUrl = new URL('/authorize', authorizationServerUrl);
}

The guard throws an informative error instead of silently producing a broken URL. The root-path fallback is kept for legitimate cases where the AS is at the domain root.

Fixes #1716.