test(mcp): add McpOAuthProvider unit tests for scope and callbackPort

Covers:
- redirectUrl uses callbackPort when set, falls back to default 19876
- redirectUri takes precedence over callbackPort when both are set
- clientMetadata includes scope when set in config
- clientMetadata omits scope when not set (backward compat)
- token_endpoint_auth_method based on clientSecret presence

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>