fix(discovery): preserve declared MCP OAuth identity

[aryasaatvik]

Summary

Preserve the OAuth credential explicitly bound to an owner-declared MCP surface when deterministic detection enriches its onboarding guidance. This prevents an unrelated OAuth credential, such as a CLI login, from being relabeled and attached to MCP.

Before / After

Case	Before	After
Declared MCP OAuth exists	First OAuth-shaped credential wins	Credential referenced by the matching declared MCP surface wins
No matching declaration	First OAuth-shaped credential wins	Existing fallback remains unchanged

Reconciliation

detected MCP URL
  -> matching owner-declared MCP surface
  -> OAuth credential referenced by that surface
  -> detected DCR/CIMD/manual-onboarding enrichment

Validation

• bun test src/lib/discover.test.ts — 8 passed
• git diff --check origin/main...fork/fix/mcp-declared-oauth-identity