Fix MCP OAuth client registration bugs

CHANGELOG · original

Fixed MCP OAuth mishandling client registrations: denying consent forced a new one, one for another redirect URI was reused, and a concurrent write could delete a valid one or keep a mismatched one