feat: handle revoked OAuth grants for MCP servers gracefully - #27264

Closes CODAGT-792.

When a user revokes an upstream OAuth grant for an MCP server used by Coder Agents, Coder kept treating the cached token as valid: invalid_grant refresh failures were logged and swallowed, the dead bearer token kept being attached, the list endpoints re-attempted the refresh on every call, and the UI kept showing the server as authenticated.

Changes

Backend, mirroring the external_auth_links prior art:

• New migration adds mcp_server_user_tokens.oauth_refresh_failure_reason. UpsertMCPServerUserToken clears it, so completing the OAuth flow again recovers the row.
• New MarkMCPServerUserTokenRefreshFailure query records the failure and clears all token material, guarded by an updated_at optimistic lock so a stale failure never clobbers a concurrently refreshed token (on a lock miss the winner's row is used).
• mcpclient.IsPermanentRefreshError classifies *oauth2.RetrieveError codes: only invalid_grant and bad_refresh_token are permanent. Client/config errors (invalid_client, unauthorized_client, ...) stay transient for the user row since reconnecting cannot fix them.
• chatd token refresh and the MCP list/get endpoints persist permanent failures, return cleared tokens for the in-flight request, and skip provider calls for already-failed rows.
• buildAuthHeaders no longer attaches an Authorization header for failed tokens, so chat degrades by omitting that server's tools instead of sending a dead bearer.

API and UI:

• No new API surface. A permanently failed token simply reports auth_connected: false, so the existing "Auth" button and "Not authenticated" tooltip appear and the user re-runs the same OAuth flow to recover. An earlier revision added an auth_status enum (connected / not_connected / reconnect_required) with a dedicated "Reconnect" button; it was collapsed to keep the API minimal since both states lead to the identical re-auth action.

Out of scope (follow-up): typed 401-on-connect detection and forced refresh. mcp-go exposes no stable typed 401 signal in the static-header path, so a revocation while the access token still looks valid locally stays undetected until expiry triggers a refresh.

Testing

• Unit and integration tests: classifier, chatd refresh paths (permanent/transient/race/persist-failure), API endpoints (revoked, transient, no-retry caching, re-auth recovery, stale-lock), dbauthz, dbcrypt, migrations.
• Dogfood UAT against a dev instance with a mock IdP returning invalid_grant: revoked grant detected on refresh and persisted once (no repeated IdP calls), chat with the revoked server selected completes with the server's tools omitted, and re-auth restores the connected state.

This PR was authored by Mux, working on Mike's behalf.