AuthSettings.issuer_url is required in resource-server-only mode but never used #3702

Release line: 2.x (main @ 754254c)

Following up on #3283, where it was noted that token_verifier= shouldn't make you invent an authorization server. I didn't find an issue tracking that, so here's one.

What happens

For a server that only verifies bearer tokens (token_verifier=, no auth_server_provider, resource_server_url=None):

• AuthSettings(resource_server_url=None) fails validation: issuer_url field required.
• MCPServer(token_verifier=...) without auth= raises "Cannot specify auth_server_provider or token_verifier without auth settings".
• With a placeholder such as issuer_url="https://placeholder.invalid", everything works: only /mcp is mounted, a missing token gets 401 and a valid one gets 200. The value is never read. It's only used when auth_server_provider is set (server.py:1218) or when the PRM document is served (server.py:1277).

Minor related point: resource_server_url is typed AnyHttpUrl | None but declared with Field(...), so None has to be passed explicitly.

What I expected

To configure a resource-server-only setup without a made-up URL.

Possible shape

• issuer_url: AnyHttpUrl | None = None and resource_server_url: AnyHttpUrl | None = None.
• Validate that issuer_url is set when resource_server_url is set, since the PRM authorization_servers needs an entry, and when auth_server_provider is used.
• Existing configs behave the same. The only change is that the placeholder is no longer needed.

The alternative would be to allow token_verifier= without auth= at all, but that's a bigger change. Does the first shape fit, or would you prefer something different? I'm happy to implement whichever you prefer.

Repro script: https://gist.github.com/AkshayShah03/92d4d4eb6dcbbfa15c7f374e30e506a5

Investigation and repro done with AI assistance; I ran it and checked the output.