fix(mcp): scope oauth callback ports per provider

[LeonSGP43]

Summary

• bind MCP OAuth redirect/callback handlers to each provider's resolved port instead of the mutable module global
• keep the legacy _oauth_port for compatibility, but stop using it as the live dispatch source once the provider is built
• add regression tests proving two providers keep distinct redirect hints and callback bind ports even after the global is overwritten

Testing

• uv run --frozen pytest -q -o addopts='' tests/tools/test_mcp_oauth.py -k "per_provider or RedirectHandlerSshHint or WaitForCallbackNoBlocking or configure_callback_port or build_oauth_auth_preserves_server_url_path"
• uv run --frozen pytest -q -o addopts='' tests/tools/test_mcp_oauth_manager.py tests/tools/test_mcp_oauth.py -k "manager or per_provider or port_stored_globally or returns_oauth_provider or scope_passed_through or pre_registered_client_id_stored"
• uv run --frozen ruff check tools/mcp_oauth.py tools/mcp_oauth_manager.py tests/tools/test_mcp_oauth.py
• git diff --check

Refs #34260

[teknium1]

Thanks for isolating the per-provider callback-port issue. The current-main premise is still valid: both construction paths overwrite _oauth_port and install shared handlers (tools/mcp_oauth.py:937-946; tools/mcp_oauth_manager.py:544-555).

Problems

• This May patch predates 755194ffe9a117c70a81505ecf4cade1fbc5af26. Current main's handlers reject non-interactive authorization before browser launch (tools/mcp_oauth.py:557) and before callback binding (tools/mcp_oauth.py:643). The new factory closures in this diff duplicate the handler bodies without those checks, then replace the provider callbacks with the unguarded closures. A direct salvage would regress the [Bug]: Headless MCP OAuth blocks gateway startup with stale cached tokens #57836 boundary contract.
• The added regressions cover build_oauth_auth, but not the changed manager callback wiring. Current manager coverage at tests/tools/test_mcp_oauth_manager.py:240-255 only verifies the provider subclass.

Suggested changes

• Preserve the two current guard checks inside the port-bound factories and test that the bound callbacks neither open a browser nor bind HTTPServer in non-interactive mode.
• Add a two-provider manager-path regression alongside the direct-construction regression.

Automated hermes-sweeper review.

[teknium1]

Resolved on main via PR #65664 (commit d34cc40), which implements the same per-flow callback-waiter direction your PR and your #34260 analysis called for — _make_callback_waiter(port) closures at both provider construction sites, with the legacy _wait_for_callback kept as a compat shim. Your branch predated the reserved-socket TOCTOU pool and the #57836 non-interactive guard so it couldn't be cherry-picked cleanly, but the direction credit is yours in the merged PR body. #34260 is closed by the merge. Thanks @LeonSGP43 — that issue writeup was the best map of this bug cluster anyone produced.