feat: proactive OAuth when enabling HTTP MCP servers

When a user enables an HTTP MCP server for a session, proactively probe
the server URL. If it returns 401 and has discoverable OAuth metadata
(RFC 9728), automatically trigger the full OAuth 2.1 + PKCE flow and
open the browser for consent — matching VS Code's behavior.

- Add requiresOAuth() probe: GET server URL → check 401 → check PRM
- Add probeAndAuthenticateHttpMcpServers() in AryxAppService
- Call proactive probe from updateSessionTooling (fire-and-forget)
- Skip servers that already have stored tokens

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

src/main/services/mcpOAuthService.ts

@@ -21,6 +21,32 @@ export interface McpOAuthFlowResult {
   error?: string;
 }
 
+/**
+ * Probes an MCP server URL to determine if it requires OAuth authentication.
+ * Returns true if the server responds with 401 and has discoverable OAuth metadata.
+ */
+export async function requiresOAuth(serverUrl: string): Promise<boolean> {
+  try {
+    const response = await fetch(serverUrl, {
+      method: 'GET',
+      signal: AbortSignal.timeout(5_000),
+    });
+
+    if (response.status !== 401) {
+      return false;
+    }
+
+    const base = serverUrl.replace(/\/+$/, '');
+    const prmResponse = await fetch(`${base}/.well-known/oauth-protected-resource`, {
+      signal: AbortSignal.timeout(5_000),
+    });
+
+    return prmResponse.ok;
+  } catch {
+    return false;
+  }
+}
+
 /**
  * Performs the full MCP OAuth 2.1 + PKCE flow:
  * 1. Discover protected resource metadata (RFC 9728)