MCP Inspector hid the body of every intercepted 401 because the tracker sat above the interceptor.

PR #2371 reorders the fetch wrappers from tracker(intercept(observer(baseFetch))) to intercept(tracker(observer(baseFetch))) (GitHub). On a 401 or 403 the auth interceptor cancelled the body and threw AuthChallengeError, so the tracker only logged an error string, and the UI renders a Response section only when responseStatus is set. The status, the WWW-Authenticate header with its resource_metadata and scope, and the body were all invisible. A second change stops awaiting the body cancel(), because with the tracker's clone as the other tee branch, cancelling one branch settles only once the clone reads to the end, so a 401 with an unending body would hang the challenge throw. Both regression tests are mutation-checked.