chore(mcp): burn down OAuth TODOs + expand headers per-request

[aheritier]

Summary

TODO debt cluster in MCP OAuth:

• pkg/tools/mcp/oauth.go:310 — client reference for elicitation
• pkg/tools/mcp/oauth.go:1149 / :1154 — no fallback when client ID missing
• pkg/tools/mcp/mcp.go:115 — headers expanded at creation time, not per request (stale-token risk on long-lived connections)
• pkg/tools/mcp/mcp.go:561 — documented "temporary fix" retry for async-init servers

Fix

Address the TODOs; expand headers per-request to avoid stale tokens. May require an upstream mcp-go check.

Acceptance

• TODOs resolved or converted to tracked decisions; per-request header expansion; tests where feasible.