feat: proactive OAuth when enabling HTTP MCP servers

When a user enables an HTTP MCP server for a session, proactively probe
the server URL. If it returns 401 and has discoverable OAuth metadata
(RFC 9728), automatically trigger the full OAuth 2.1 + PKCE flow and
open the browser for consent — matching VS Code's behavior.

- Add requiresOAuth() probe: GET server URL → check 401 → check PRM
- Add probeAndAuthenticateHttpMcpServers() in AryxAppService
- Call proactive probe from updateSessionTooling (fire-and-forget)
- Skip servers that already have stored tokens

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

tests/main/sessionToolingConfig.test.ts

@@ -5,6 +5,7 @@ import {
   validateSessionToolingSelectionIds,
 } from '@main/sessionToolingConfig';
 import type { SessionToolingSelection, WorkspaceToolingSettings } from '@shared/domain/tooling';
+import type { RunTurnRemoteMcpServerConfig } from '@shared/contracts/sidecar';
 
 const TIMESTAMP = '2026-03-25T00:00:00.000Z';
 
@@ -157,7 +158,7 @@ describe('session tooling config helpers', () => {
       () => 'my-token',
     );
 
-    expect(config?.mcpServers[0].headers).toEqual({
+    expect((config?.mcpServers[0] as RunTurnRemoteMcpServerConfig).headers).toEqual({
       'X-Custom': 'value',
       Authorization: 'Bearer my-token',
     });
@@ -170,6 +171,6 @@ describe('session tooling config helpers', () => {
       () => undefined,
     );
 
-    expect(config?.mcpServers[0].headers).toEqual({ Authorization: 'Bearer token' });
+    expect((config?.mcpServers[0] as RunTurnRemoteMcpServerConfig).headers).toEqual({ Authorization: 'Bearer token' });
   });
 });