fix(web): address Copilot review on the OAuth recovery failure arms

Three findings, all valid:

- `beginInteractiveAuthorization` navigated *before* awaiting provider
  creation and flow-state recording, so a rejection could arrive after
  the browser had been handed over — and the web catch clears the resume
  snapshot on one. Fixed at the root: the navigation now resolves last,
  after every fallible step, which makes every rejection the method can
  produce a pre-navigation rejection. It is also better on its own
  terms — a provider that cannot be built means the callback could not
  have completed, so navigating first only bought a dead-end round trip.
- `resumePendingReauth` restored the pending slot unconditionally, which
  could overwrite a newer challenge deferred while it was awaiting.
  Restores only into an empty slot, so latest wins.
- the `authChallengeInteractive` catch re-read the active server rather
  than the one the challenge arrived for. `serverId` is now captured
  synchronously in the listener and used by both the body and the catch.

Three new tests, one per finding, each driving the interleaving rather
than the happy path.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Quk1hBUtyhkXowwMXzAnAY
Signed-off-by: cliffhall <cliff@futurescale.com>

clients/web/src/test/core/mcp/oauthManager.test.ts

@@ -2847,6 +2847,26 @@ describe("OAuthManager", () => {
       parseSpy.mockRestore();
     });
 
+    it("does not navigate when the fallible setup rejects", async () => {
+      // #2165: the web client drops its OAuth resume snapshot when this
+      // rejects, which is only sound because the navigation resolves last.
+      const params = createMockParams();
+      storageOf(params).getClientInformation.mockRejectedValue(
+        new Error("client information unreadable"),
+      );
+      const manager = new OAuthManager(params);
+
+      await expect(
+        manager.beginInteractiveAuthorization(
+          new URL("https://auth.example.com/authorize"),
+        ),
+      ).rejects.toThrow("client information unreadable");
+      expect(
+        params.initialConfig.navigation!.navigateToAuthorization,
+      ).not.toHaveBeenCalled();
+      expect(params.dispatchOAuthAuthorizationRequired).not.toHaveBeenCalled();
+    });
+
     it("throws when navigation is not configured", async () => {
       const params = createMockParams({
         initialConfig: {