Claude Design first-party MCP always 403s: transport never attaches design-scoped token, `claude mcp login` OAuth flow is dead, and the error message suggests a nonexistent `/design-login` command

Environment:

• Claude Code v2.1.261 (latest at time of filing), macOS (Darwin 24.6.0)
• claude.ai Max account with confirmed Claude Design access (web UI works; the MCP itself worked from this machine in early July 2026)
• Server config (user scope): "claude-design": {"type": "http", "url": "https://api.anthropic.com/v1/design/mcp"}

Symptom:
Connection fails every session with:

FIRST_PARTY_AUTH_REJECTED: api.anthropic.com rejected your claude.ai login for Claude Design (HTTP 403) ... Run /design-login and retry

What I verified:

1. /design-login — the command the error message recommends — does not exist ("command not found"). Phantom command.
2. My claudeAiOauth token scopes are [file_upload, inference, mcp_servers, profile, sessions:claude_code]. The server's live WWW-Authenticate header demands scope="user:design:read user:design:write". The standard /login flow never requests design scopes, and the MCP HTTP transport never attaches any other credential → 403 is guaranteed. (Same root cause as closed issue #69317.)
3. claude mcp login claude-design cannot mint the missing token: the flow hits a decommissioned /authorize endpoint (HTTP 410) and hangs. (Same as closed issue #77620.) The resource metadata at https://api.anthropic.com/v1/design/.well-known/oauth-protected-resource advertises https://claude.ai/v1/design/mcp as the authorization server, but that server publishes no valid oauth-authorization-server metadata (404), so RFC 9728 discovery dead-ends too.
4. Ruled out local causes: single config scope, no duplicate/shadowed entries, endpoint alive (405/401 on unauthenticated probes), latest CLI, entitled account.

Ask:
Both prior issues (#69317, #77620) were closed without a fix, but the failure is fully reproducible and self-consistent: no token with design scopes can be obtained, and no design-scoped token would be attached if it existed. Please either (a) fix the OAuth flow + token attachment for the claude-design first-party server, or (b) remove the server type and the /design-login suggestion from the error copy so users stop chasing a nonexistent command.