fix(mcp): Upgrade SDK and add callbackPort/callbackPath config

[christso]

Closes #5766

Summary

• Upgrade MCP SDK to 1.25.1 to fix authorization URL bug
• Add configurable callbackPort and callbackPath for OAuth callback
• Support dynamic port allocation with callbackPort: 0

Problem

1. Wrong authorization URL: MCP SDK 1.15.1 incorrectly constructs the authorization URL by appending /authorize to the issuer URL instead of using authorization_endpoint from OAuth metadata.

2. No callback config: Users cannot configure the OAuth callback URL to match what's registered on their OAuth server.

3. SSH port forwarding: Users running opencode over SSH may only be able to forward specific ports, requiring explicit port configuration.

Solution

1. Upgrade MCP SDK to 1.25.1 which correctly reads authorization_endpoint from OAuth discovery metadata.

2. Add callback config options:

   • callbackPort: OAuth callback server port (default: 19876, set to 0 for dynamic)
   • callbackPath: OAuth callback path (default: /mcp/oauth/callback)

User Configuration

"mcp": {
  "<server-name>": {
    "type": "remote",
    "url": "https://<your-mcp-server>",
    "oauth": {
      "clientId": "your-client-id",
      "callbackPort": 8080,
      "callbackPath": "/oauth/callback",
      "scope": "openid profile email"
    }
  }
}

For dynamic port (OS assigns available port, similar to VSCode's approach):

"oauth": {
  "callbackPort": 0
}

Test plan

• Test OAuth flow works as before (no config changes)
• Test configurable callback port/path
• Test dynamic port allocation with callbackPort: 0
• Unit tests for ensureRunning behavior
• Fix mcp debug command to use actual allocated port

---

🤖 Generated with Claude Code

[christso]

---

Future Enhancement Note: Dynamic port allocation (binding to port 0 and letting the OS assign an available port, similar to VSCode's approach) could be explored in a future PR for environments without strict redirect URI requirements. This would eliminate port conflicts entirely. The redirectUri config added here would remain useful as an override for OAuth providers requiring exact URI matches.