mcpx: report 'waiting for OAuth sign-in' instead of a generic discover timeout (mcp-remote pending state not detected) #270

Problem

When an mcp-remote OAuth sign-in is started but never finished, every start of that server blocks in mcp-remote's browser flow and mcpx surfaces only a generic discover/start timeout. The user gets a one-minute mystery instead of a one-line instruction naming the state and the command that finishes it.

This is the same defect as dezren39/darwin-nix#370 (fixed there by dezren39/nix PR #383, merge fd301a5). It is still present in this repo's pkgs/mcpx copy.

Evidence (verified on main a9d14e2, 2026-10-18)

• pkgs/mcpx/internal/pool/oauthwait.go and oauthwait_test.go do not exist in this repo (they exist in dezren39/nix's copy).
• pkgs/mcpx/internal/pool/pool.go Pool.startLane (~line 606) returns the raw start error: return nil, fmt.Errorf("server %q: %w", p.cfg.Name, err) — no pending-sign-in check. A full-tree diff of pkgs/mcpx/internal/pool/pool.go against dezren39/nix's post-fix copy differs at exactly this line.
• No issue in this repo mentions OAuth (searched open + closed).

Background: mcp-remote parks an unfinished sign-in on disk — ~/.mcp-auth/mcp-remote-*/<md5(url)> gains client_info.json + code_verifier when the browser flow starts, and tokens.json only when it completes. While that state holds, mcp-remote blocks opening a browser and waiting, so mcpx sees nothing but a timeout.

Suggested fix (mirror dezren39/nix PR #383)

• Add internal/pool/oauthwait.go: detect the pending state (stdio server whose command base is mcp-remote, first http(s) arg as URL, per-server dir keyed by md5(url) with client_info.json + code_verifier present and tokens.json absent).
• Wrap the start failure in Pool.startLane with the detection: on a pending sign-in, the error names the state, the URL, the state dir, and the exact mcp-remote <url> command to finish the sign-in. Conservative negatives (finished sign-in, never-started, non-mcp-remote, HTTP servers) keep the original error untouched.
• Port oauthwait_test.go from dezren39/nix (detector cases + wrap behaviour).

Acceptance criteria

• A start failure for an mcp-remote server with a pending sign-in produces an error containing 'waiting for OAuth sign-in' and the finish command.
• Finished / never-started / non-mcp-remote / HTTP cases return the original error unchanged (unit-tested).
• go test ./internal/pool/ passes; the new tests fail without the fix (ablation).