fix(oauth): complete browser callbacks before tool sync

[aryasaatvik]

Summary

Return browser OAuth callbacks after the refreshed grant and connection are durable, without waiting for remote tool discovery. This prevents a slow MCP catalog from keeping the popup open until the host cancels the request, while programmatic completion retains its synchronous catalog guarantee.

Lifecycle

browser callback
  -> exchange authorization code
  -> persist credential + connection
  -> return popup success
  -> host waitUntil
       -> discover remote tools
       -> replace persisted catalog

• A fresh grant clears catalog freshness so an interrupted background sync converges on the next tools read.
• Background failures are logged and traced without rolling back the already-durable connection.
• Explicit SDK callers continue to wait for tool synchronization by default.

Validation

• bunx vitest run src/oauth-flow.test.ts — 40 passed
• bunx vitest run --project selfhost selfhost/mcp-oauth-callback-background-sync.test.ts — 1 passed
• bun run typecheck in the SDK, API, and MCP packages
• oxlint --deny-warnings on all changed files