## What happened?

An `oauth_delegate` server with `dcr_bridge: true` can complete DCR, PKCE authorization, and token exchange successfully but return zero tools because the bridge copies the upstream OAuth `token_type` value verbatim into the protected-resource Authorization header.

A standards-based remote MCP provider returns `token_type: "bearer"` in lowercase. LiteLLM seals that value and later emits `Authorization: bearer <token>` from `resolve_bridge_envelope`. This provider treats the scheme casing strictly and returns HTTP 401 `invalid_token`.

A provider-neutral direct DCR/PKCE probe using the exact same token proved:

- `Authorization: bearer <token>` -> MCP initialize HTTP 401, `invalid_token` - `Authorization: Bearer <token>` -> MCP initialize HTTP 200 - tools/list -> HTTP 200 with 32 tools

No token value is logged; the probe correlates attempts by a truncated SHA-256 fingerprint.

## Expected behavior

Canonicalize a case-insensitive OAuth token type of `bearer` to the interoperable `Bearer` scheme before protected-resource egress. RFC 6749 defines the token type value as case insensitive. Other token types can remain unchanged.

Minimal change in `outbound_credenti…