Figma MCP 403 Forbidden: Why client_name allowlists fail

igma's remote MCP server admits clients by the client_name they send during dynamic client registration. Why that check proves nothing, what CIMD fixes and what it doesn't, and what to gate on instead.