Implement TokenVerifier protocol for mcp-python-sdk compatibility

Fixes breaking changes from mcp-python-sdk PR #982 which updated
BearerAuthBackend to use TokenVerifier protocol instead of OAuth providers.

Changes:
- Add verify_token() method to BearerAuthProvider implementing TokenVerifier protocol
- Add verify_token() method to InMemoryOAuthProvider implementing TokenVerifier protocol
- Update BearerAuthBackend usage in setup_auth_middleware_and_routes() to pass TokenVerifier
- Add comprehensive unit tests for TokenVerifier implementations
- Add integration tests for BearerAuthBackend with TokenVerifier
- Add tests for HTTP auth setup functions

All existing functionality preserved with full backwards compatibility.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

src/fastmcp/server/auth/providers/bearer.py

@@ -385,6 +385,21 @@ class BearerAuthProvider(OAuthProvider):
             return scope_claim
         return []
 
+    async def verify_token(self, token: str) -> AccessToken | None:
+        """
+        Verify a bearer token and return access info if valid.
+
+        This method implements the TokenVerifier protocol by delegating
+        to our existing load_access_token method.
+
+        Args:
+            token: The JWT token string to validate
+
+        Returns:
+            AccessToken object if valid, None if invalid or expired
+        """
+        return await self.load_access_token(token)
+
     # --- Unused OAuth server methods ---
     async def get_client(self, client_id: str) -> OAuthClientInformationFull | None:
         raise NotImplementedError("Client management not supported")

src/fastmcp/server/auth/providers/in_memory.py

@@ -271,6 +271,21 @@ class InMemoryOAuthProvider(OAuthProvider):
             return token_obj
         return None
 
+    async def verify_token(self, token: str) -> AccessToken | None:
+        """
+        Verify a bearer token and return access info if valid.
+
+        This method implements the TokenVerifier protocol by delegating
+        to our existing load_access_token method.
+
+        Args:
+            token: The token string to validate
+
+        Returns:
+            AccessToken object if valid, None if invalid or expired
+        """
+        return await self.load_access_token(token)
+
     def _revoke_internal(
         self, access_token_str: str | None = None, refresh_token_str: str | None = None
     ):

src/fastmcp/server/http.py

@@ -87,7 +87,7 @@ def setup_auth_middleware_and_routes(
     middleware = [
         Middleware(
             AuthenticationMiddleware,
-            backend=BearerAuthBackend(provider=auth),
+            backend=BearerAuthBackend(auth),
         ),
         Middleware(AuthContextMiddleware),
     ]