fix(mcp): repair standalone OAuth login discovery

[aheritier]

Stacked on #3955/#3881. This intentionally combines PR4a–4c because discovery, credentials, and token-key behavior are coupled.

Summary:

• Forward the full latest.Remote.
• Match names and URLs exactly.
• Use authoritative challenge metadata, with path→root fallback only when metadata is absent.
• Require configured-only credentials for explicit ID/secret (no DCR); use DCR with no prompt when there is no ID.
• Preserve exact scopes across DCR, authorize, and RequestedScopes.
• Use Remote.URL verbatim as the resource/key.
• Add safe local httptest coverage.

Callback behavior is intentionally unchanged/deferred (PR4d/Q2). Documentation is planned in PR5.

No secrets, private test data, or logs are included.

Validation

• go test ./cmd/root/... ./pkg/tools/mcp/...
• go test ./e2e -run TestDependencies
• Manual: run debug OAuth login against a configured remote, confirm fresh consent and a read-only Jira request succeed; confirm configured client credentials avoid DCR and the configured remote URL is retained verbatim for authorization/token storage.

Callback-port/redirect behavior is intentionally deferred to a follow-up. Stacked on #3955/#3881.

Manual validation

• Build the local binary and invoke docker-agent debug oauth login <agent-config> <remote-name> against a test remote.
• Verify fresh consent and a read-only Jira call.
• If available, verify configured explicit client credentials avoid DCR.
• Verify the configured remote URL is retained exactly for authorization and token storage.
• OAuth output and URLs are sensitive; keep them local and do not publish them. Callback customization is covered by fix(mcp): honor callback configuration in standalone OAuth login #3977.