fix: narrow .well-known route matching to specific OAuth paths
Previously hatk intercepted all /.well-known/ routes, causing non-OAuth
paths like apple-app-site-association to 404. Now only the two OAuth
well-known routes are intercepted, letting others fall through to the
framework handler.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>