Keep concurrent MCP OAuth writes from wiping tokens

[TheGreatAxios]

Summary

MCP OAuth auth state was full-snapshot last-writer-wins. A concurrent session (or second connect) could save a new PKCE code verifier and erase tokens just written by another session — Linear often ended with only client registration + verifier and no tokens, while the UI could still look connected. Concurrent re-auth also races PKCE (Invalid PKCE code_verifier). Stale dynamic client registration against a previous loopback port made re-auth fail as well.

This has been latent since remote MCP OAuth landed (#44).

Changes

• Serialize read-modify-write per auth file and add updateAuthState so field patches merge instead of clobbering
• Use unique temp paths so concurrent renames do not hit ENOENT
• Drop stale DCR clients when the loopback redirect port no longer matches and there are no refreshable tokens
• Regression tests for concurrent token+verifier writes and redirect mismatch

Test plan

• bun run typecheck
• bun test ./src/mcp
• Clear Linear auth, re-auth once with a single Corbits process built from this branch, confirm durable tokens on disk
• Confirm two concurrent connects no longer wipe tokens when one saves a verifier

Linear

Fixes CL-6679
https://linear.app/abklabs/issue/CL-6679/keep-concurrent-mcp-oauth-writes-from-wiping-tokens

Supersedes closed PR #487 (same commit 27d3136). Branch was renamed fix/mcp-oauth-token-persist → cl-6679-keep-concurrent-mcp-oauth-writes-from-wiping-tokens, which closed #487 as a side effect.

[linear-code]

CL-6679