Bind MCP OAuth handlers per provider

[LeonSGP43]

Summary

• bind MCP OAuth redirect and callback handlers to each provider's resolved callback port
• keep the legacy module-level wrappers for backward compatibility
• add focused regressions for the factory closures and manager wiring

Closes #44588

[liuhao1024]

Verification review — reviewed this PR's diff (per-provider OAuth handler closures for MCP).

What I checked:

• _make_redirect_handler(callback_port) and _make_wait_for_callback(callback_port) correctly close over the port at factory creation time, replacing the mutable module-level _oauth_port
• Back-compat wrappers _redirect_handler and _wait_for_callback delegate to the factory with _oauth_port as fallback
• build_oauth_auth now passes cfg["_resolved_port"] to the factories instead of relying on the module global
• _build_provider in mcp_oauth_manager.py imports the new factory functions
• Tests verify closed-over port is used (not the module-level _oauth_port), and that the manager passes per-server handlers to the provider

Verdict: Clean. The closure-over-port pattern correctly prevents concurrent OAuth flows from interfering with each other's SSH hint messages and callback listeners.

[alt-glitch]

Duplicate of #34280 (earlier open PR, same approach) — bind MCP OAuth redirect/callback handlers per provider via factory closures instead of module-level globals. Same root cause as #34260/#5344. Closes #44588.

[teknium1]

Thanks for isolating the mutable callback-port race with per-provider closures. Current main still has that race: _configure_callback_port() writes _oauth_port at tools/mcp_oauth.py:828-832, and both construction paths pass global-reading handlers (tools/mcp_oauth.py:945-946; tools/mcp_oauth_manager.py:544-555).

Problems

• The new redirect factory starts at tools/mcp_oauth.py:402 without current main's _raise_if_non_interactive(...) boundary guard (tools/mcp_oauth.py:557).
• The callback factory binds at tools/mcp_oauth.py:464 without current main's pre-bind guard (tools/mcp_oauth.py:643). Those protections were added in 755194ffe9a117c70a81505ecf4cade1fbc5af26; applying this June snapshot would regress background OAuth fail-fast behavior.

Suggested changes

• Salvage the closures into the current guarded handlers, keeping both guards inside the factory-produced handlers.
• Update the closure tests to assert no URL/browser/listener activity for non-interactive flows, alongside the closed-over-port assertions.

Automated hermes-sweeper review.

[teknium1]

Please preserve current main's _raise_if_non_interactive(...) guard inside this factory before URL output or browser launch. The equivalent current handler guards at tools/mcp_oauth.py:557 (commit 755194ffe); omitting it reintroduces background OAuth flows that cannot be completed.

[teknium1]

Resolved on main via PR #65622, which merged the same per-provider closure approach (salvaged from #44872, with #5345 by @caseyg as the earliest submission — all credited). Thanks for the contribution @LeonSGP43!