fix(oauth): require exact explicit DCR redirect match

[SwedishChef1]

Summary

• treat a caller-supplied DCR redirectUri as authoritative
• register a fresh uniquely named client when a legacy candidate has no recorded redirect
• preserve the legacy client so existing connections can continue refreshing through it
• retain legacy-null reuse when callers rely on Executor's configured default redirect

Why

A persisted DCR client from before origin_redirect_uri was recorded currently matches every callback. A host moving from an ephemeral callback to an explicit stable callback can therefore reuse a client registered for the old URL, causing strict authorization servers to reject the authorization request. Deleting that client is unsafe because existing connections may still use it for refresh.

Verification

• regression test fails on main: the legacy client is reused despite an explicit callback
• bun run test -- src/oauth-register-dynamic.test.ts: 17 passed
• SDK suite: 64 files, 921 tests passed
• MCP host suite: 9 files, 251 tests passed
• self-host mcp-oauth-reconnect-origin-drift E2E: passed
• bun run format:check: passed
• bun run lint: passed
• bun run typecheck: 45/45 packages passed

The monorepo-wide concurrent bun run test exceeded unrelated timing budgets in the 10,000-tool MCP test, stdio daemon startup, and local data-dir ownership test. Each reported failing suite/test passed when rerun in isolation; the full SDK suite also passed.