fix(mcp): stop OAuth callback server after authentication completes

[hchangjae]

Issue for this PR

Closes #23562

Type of change

• Bug fix
• New feature
• Refactor / code improvement
• Documentation

What does this PR do?

The OAuth callback server (port 19876) stays running after authenticate() completes. When multiple TUI instances are running, the first instance holds the port and subsequent instances can't receive their own OAuth callbacks — their state is registered in their own process-local pendingAuths Map, but the callback arrives at the first instance's server where pendingStates=[], resulting in CSRF errors.

This adds stopIfIdle() to McpOAuthCallback that stops the server only when no pending auth flows remain, and calls it after authenticate() resolves (both success and state-mismatch paths). This is safe for concurrent auth flows — the server only stops when all pending auths are resolved.

How did you verify your code works?

• Verified stopIfIdle() only calls stop() when pendingAuths.size === 0
• Confirmed the callback server lifecycle: ensureRunning() → auth flow → stopIfIdle() → port released
• Traced all code paths in authenticate() to ensure cleanup on both success and error
• Existing oauth-callback.test.ts tests use McpOAuthCallback.stop() in afterEach — same pattern

Checklist

• I have tested my changes locally
• I have not included unrelated changes in this PR

[hchangjae]

Recreating with cleaner commit.