fix(mcp): persist OAuth discovery state

[rekram1-node]

Summary

• persist MCP OAuth discovery metadata across the browser redirect
• implement the SDK v2 discovery-state provider hooks for normal and pending auth flows
• support discovery and verifier credential invalidation scopes

This restores SEP-2352 callback-leg authorization-server binding and removes the SDK warning about unavailable discovery state.

Verification

• bun test test/mcp/oauth-provider.test.ts test/mcp/oauth-callback.test.ts
• bun typecheck
• git diff --check