fix(mcp): clean up stale OAuth cache when auth type changes (#60313)

[DavidMetcalfe]

Summary

When a user switches an MCP server from auth: oauth to headers-based auth (or removes auth entirely), the cached mcp-tokens/<name>.client.json files are left as orphaned disk cruft. These files don't independently trigger OAuth (the flow is correctly gated by self._auth_type == "oauth" in MCPServerTask._connect()), but their presence confuses debugging — as reported in #60313.

What this does

Adds a best-effort cleanup step in MCPServerTask._connect(). When _auth_type != "oauth", any stale OAuth cache files (tokens, client info, metadata) are removed. The cleanup is wrapped in try/except OSError so permission errors never block server startup.

Changes

• tools/mcp_tool.py: In the else branch of if self._auth_type == "oauth", call HermesTokenStorage.remove() to clean up any stale cache
• tests/tools/test_mcp_oauth.py: Two new tests — one verifying cleanup removes all three cache files, one verifying cleanup is a no-op when no files exist

Testing

$ python -m pytest tests/tools/test_mcp_oauth.py -q
107 passed in 3.22s

Notes

• The stale cache files do not independently trigger OAuth browser popups — the OAuth flow is correctly gated by the auth: oauth config field
• The dual-config situation (Dual config.yaml sources cause confusing MCP OAuth behavior #60313 Issue 1) is a separate documentation/UX concern and is not addressed here

Closes #60313