fix: only probe OAuth for newly enabled MCP servers

Previously, every tooling update re-probed all enabled HTTP MCP servers
for OAuth requirements. Now it compares the new selection against the
previous one and only probes servers that were just enabled.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

src/main/AryxAppService.ts

@@ -1009,16 +1009,24 @@ export class AryxAppService extends EventEmitter<AppServiceEvents> {
       selection,
     );
 
+    const previousEnabledMcpServerIds = new Set(session.tooling?.enabledMcpServerIds ?? []);
     session.tooling = selection;
     session.updatedAt = nowIso();
     const result = await this.persistAndBroadcast(workspace);
 
-    // Proactively authenticate HTTP MCP servers that need OAuth
-    void this.probeAndAuthenticateHttpMcpServers(
-      sessionId,
-      resolveProjectToolingSettings(workspace.settings, project.discoveredTooling),
-      selection,
-    );
+    // Proactively authenticate only newly enabled HTTP MCP servers
+    const newlyEnabledIds = selection.enabledMcpServerIds.filter((id) => !previousEnabledMcpServerIds.has(id));
+    if (newlyEnabledIds.length > 0) {
+      const selectionForNewServers = normalizeSessionToolingSelection({
+        enabledMcpServerIds: newlyEnabledIds,
+        enabledLspProfileIds: [],
+      });
+      void this.probeAndAuthenticateHttpMcpServers(
+        sessionId,
+        resolveProjectToolingSettings(workspace.settings, project.discoveredTooling),
+        selectionForNewServers,
+      );
+    }
 
     return result;
   }