fix: stop reporting client-error OAuth exceptions to Nightwatch (#261)

League\OAuth2\Server\Exception\OAuthServerException with a status
below 500 (invalid/missing/expired bearer tokens, invalid_grant, etc.)
represents a client error, not an application failure, but Passport's
TokenGuard explicitly calls report() on every failed bearer-token
check. This was flooding Nightwatch with 401 noise from bots probing
the public MCP endpoint. Actual server_error (500) responses are still
reported.

bootstrap/app.php

@@ -11,6 +11,7 @@
 use Illuminate\Foundation\Configuration\Middleware;
 use Illuminate\Http\Middleware\AddLinkHeadersForPreloadedAssets;
 use Illuminate\Http\Request;
+use League\OAuth2\Server\Exception\OAuthServerException;
 use Symfony\Component\HttpKernel\Exception\TooManyRequestsHttpException;
 
 return Application::configure(basePath: dirname(__DIR__))
@@ -44,6 +45,10 @@
         ]);
     })
     ->withExceptions(function (Exceptions $exceptions): void {
+        $exceptions->dontReportWhen(function (Throwable $e) {
+            return $e instanceof OAuthServerException && $e->getHttpStatusCode() < 500;
+        });
+
         $exceptions->renderable(function (TooManyRequestsHttpException $e, Request $request) {
             if ($request->expectsJson()) {
                 $retryAfter = $e->getHeaders()['Retry-After'] ?? null;

tests/Feature/Passport/OAuthServerExceptionReportingTest.php

@@ -0,0 +1,26 @@
+<?php
+
+declare(strict_types=1);
+
+use Illuminate\Contracts\Debug\ExceptionHandler;
+use League\OAuth2\Server\Exception\OAuthServerException;
+
+test('client-error oauth exceptions are not reported', function () {
+    $handler = app(ExceptionHandler::class);
+
+    expect($handler->shouldReport(OAuthServerException::accessDenied()))->toBeFalse()
+        ->and($handler->shouldReport(OAuthServerException::invalidGrant()))->toBeFalse()
+        ->and($handler->shouldReport(OAuthServerException::invalidRequest('grant_type')))->toBeFalse();
+});
+
+test('server-error oauth exceptions are still reported', function () {
+    $handler = app(ExceptionHandler::class);
+
+    expect($handler->shouldReport(OAuthServerException::serverError('unexpected failure')))->toBeTrue();
+});
+
+test('unrelated exceptions are unaffected', function () {
+    $handler = app(ExceptionHandler::class);
+
+    expect($handler->shouldReport(new RuntimeException('boom')))->toBeTrue();
+});