Test executor-routed MCP OAuth token exchange

[jif-oai]

Why

#28529 proves OAuth discovery uses the selected executor, but its end-to-end test stops before the callback and token exchange.

What changed

• add an executor-only mock token endpoint
• complete the OAuth callback using the authorization URL's state and redirect_uri
• assert the PKCE token exchange reaches the executor-only endpoint
• assert the completion notification reports the selected thread and succeeds

Depends on #28529.