fix(mcp): preserve OAuth policy and smooth settings transitions

[kev1n77]

Summary

• Preserve explicit OAuth settings when importing, exporting, validating, and deduplicating MCP configurations.
• Prevent MCP background polling from shifting existing server cards or temporarily clearing stale-state indicators.
• Smooth detail collapse and authentication dialog exit transitions.
• Add regression coverage for OAuth policy compatibility, polling behavior, and dialog closing and reopening.

Type and Areas

Type: Bug fix, UI/UX

Areas: Rust MCP services, Web UI settings

Motivation / Impact

An MCP server configured with oauth: false could unexpectedly start OAuth because the configuration parser discarded the boolean value. Explicit OAuth policy now survives configuration round trips and participates in configuration identity.

Background polling could briefly insert a loading placeholder above existing cards. MCP detail collapse also left a temporary padded gap, while closing the authentication dialog removed its body before the exit animation finished. These transitions now preserve stable content and layout through completion.

Verification

Passed:

• pnpm --dir src/web-ui run test:run src/infrastructure/config/components/McpToolsConfig.test.tsx src/infrastructure/config/components/McpToolsConfig.presentation.test.ts src/infrastructure/config/components/common/ConfigCollectionItem.test.tsx — 24 tests.
• pnpm run check:web — type checking and appearance/theme checks.
• pnpm run motion:audit — completed the motion inventory.
• cargo test -p openbitfun-services-integrations --no-default-features --features mcp --test mcp_contracts mcp_cursor_ — 4 tests.
• cargo test -p openbitfun-services-integrations --no-default-features --features mcp --test mcp_contracts mcp_json_config_helpers — 1 test.
• cargo test -p openbitfun-services-integrations --no-default-features --features mcp --test mcp_contracts mcp_config_merge_helpers — 1 test.
• cargo test -p openbitfun-services-integrations --no-default-features --features mcp --test mcp_contracts remote_mcp_oauth_can_be_explicitly_disabled — 1 test.

Verification used local automated tests, including simulated Peer Device capability changes. No live remote-workspace, remote-control, Peer Device, or Detached Dispatch integration was exercised. Animation appearance was not manually verified in the desktop window.

Reviewer Notes

• Legacy configurations without an explicit OAuth policy retain their existing default behavior.
• OAuth option objects remain supported. Invalid or conflicting boolean policies produce validation errors.
• Authentication dialog content remains available during exit; credential input is cleared on close.
• No new user-facing strings or migration steps are required.

Checklist

• This PR is focused and does not include secrets, temporary prompts, generated scratch files, or unrelated artifacts.
• Relevant verification is recorded above, or skipped checks are explained.
• User-facing strings, docs, and locales are updated where applicable.