Fix OAuth redirect URI mismatch in debug flow

[bhosmer-ant]

Summary

• Registers both normal (/oauth/callback) and debug (/oauth/callback/debug) redirect URIs in OAuth client metadata
• Prevents redirect URI mismatch errors when switching between connection flow and Auth tab debug mode
• Adds debugRedirectUrl getter to base class for cleaner code organization

Problem

Steps to reproduce:

1. Connect to a server with auth (e.g. the one defined in https://github.com/modelcontextprotocol/example-remote-server)
2. Go through the OAuth flow on connection. This uses the /oauth/callback endpoint
3. Go to the Auth tab and choose either Quick Refresh or Guided Token Refresh. This attempts to use the /oauth/callback/debug endpoint on the current client, resulting in an "unregistered redirect uri" error
4. Reconnect. This clears the current client and does not reauthorize on connection
5. Go to the Auth tab and choose either Quick Refresh or Guided Token Refresh. A new client is created with the /oauth/callback/debug endpoint registered. Flow works normally

Root cause:

The OAuth client was only registering the /oauth/callback redirect URI at connection time, but the Auth tab's debug flows require /oauth/callback/debug. This caused a redirect URI mismatch error.

Fix:

Register both /oauth/callback and /oauth/callback/debug redirect URIs at connection time, making both endpoints available for all OAuth flows.

Test plan

• Test normal OAuth connection flow works
• Test Auth tab debug mode OAuth flow works
• Verify both redirect URIs are registered in client metadata

[github-actions]

🎭 Playwright E2E Test Results

✅  24 passed

Details

24 tests across 3 suites
 35.5 seconds
 70ddef2
ℹ️  Test Environment: Ubuntu Latest, Node.js v22.19.0
Browsers: Chromium, Firefox

📊 View Detailed HTML Report (download artifacts)

[max-stytch]

LGTM