Function auth_callbacks_router 

pub fn auth_callbacks_router(servers: &[&McpServer]) -> Router

The origin-global II auth-callback allow-list (II #4091): before contacting the connect callback named in the (attacker-craftable) link fragment, II fetches this origin’s /.well-known/ii-auth-callbacks and requires the callback to be EXACTLY one of the declared entries — fail-closed, so serving it is mandatory once #4091 ships. The path carries no instance prefix, so ONE document must declare every instance’s callback: pass all of an origin’s McpServers and merge the router at the application root. CORS-open (II’s frontend fetches it cross-origin).