fix(mcp): reuse cached OAuth redirect port on re-auth (salvage of #49249)

[teknium1]

Infographic

Summary

MCP OAuth re-authentication reuses the callback port pinned in the cached client registration, so providers that bind redirect URIs at dynamic-client-registration time no longer reject re-auth with invalid_redirect_uri.

Salvage of #49249 by @x9x9x9x9x9x91 (cherry-picked, authorship preserved). Their branch predated the reserved-socket TOCTOU pool (#65622) and per-flow waiters (#65664); the conflict resolution composes both: port precedence is now explicit config → cached registration port → fresh port through _reserve_callback_port() (only truly-fresh picks enter the TOCTOU reservation pool; cached/explicit ports are fixed values that bind via the reuse_address path).

Changes

• tools/mcp_oauth.py: _cached_redirect_port(storage) parses the loopback callback port from the cached client registration (handles both 127.0.0.1 and localhost URI forms); _configure_callback_port(cfg, storage) gains the precedence chain
• tools/mcp_oauth_manager.py: pass storage through
• tests/tools/test_mcp_oauth.py: cached-port reuse + explicit-override tests (@x9x9x9x9x9x91)

Validation (E2E, isolated HERMES_HOME)

Check	Result
Re-auth with cached registration reuses pinned port 57727	pass
First auth (no cache) unchanged — fresh port, TOCTOU pool engaged	pass
localhost-form cached URI parses (redirect_host users)	pass
Explicit redirect_port wins over cache; corrupt cache falls through	pass
test_mcp_oauth.py + test_mcp_oauth_manager.py	120/120

[alt-glitch]

This was generated by AI during triage.

Related to #49249: this is its current-main salvage, preserving cached redirect-port reuse while composing with the newer callback-port reservation/waiter work.