fix(client): honor custom claims override in createPrivateKeyJwtAuth

[Christian-Sidak]

Summary

• Remove redundant jose setter calls (.setIssuer, .setSubject, .setAudience, .setIssuedAt, .setExpirationTime, .setJti) that silently overwrote user-provided custom claims after they had already been merged into the claims object via { ...baseClaims, ...options.claims }
• The six reserved claims are already present in the merged object via baseClaims, so the setter calls were redundant for the default case and harmful when users provided overrides -- contradicting the documented "custom claims taking precedence" contract
• Add regression test verifying that overlapping reserved claims (iss, sub, aud) from options.claims are honored in the signed JWT

Fixes #1914

[changeset-bot]

🦋 Changeset detected

Latest commit: d27bb98

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@modelcontextprotocol/client	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[pkg-pr-new]

Open in StackBlitz

@modelcontextprotocol/client

npm i https://pkg.pr.new/@modelcontextprotocol/client@1918

@modelcontextprotocol/server

npm i https://pkg.pr.new/@modelcontextprotocol/server@1918

@modelcontextprotocol/express

npm i https://pkg.pr.new/@modelcontextprotocol/express@1918

@modelcontextprotocol/fastify

npm i https://pkg.pr.new/@modelcontextprotocol/fastify@1918

@modelcontextprotocol/hono

npm i https://pkg.pr.new/@modelcontextprotocol/hono@1918

@modelcontextprotocol/node

npm i https://pkg.pr.new/@modelcontextprotocol/node@1918

commit: d27bb98