Support cloud-side OAuth credential capture for MCP installs

Problem

agent-canvas can now install MCP servers that use MCP-server-managed OAuth locally by calling the agent-server /api/mcp/test endpoint. That endpoint runs the OAuth flow and returns an updated MCP server object containing encrypted oauth_credentials, which are then persisted in settings so the user only authenticates once.

For cloud backends, agent-canvas currently cannot call a local /api/mcp/test equivalent. The UI short-circuits the test path with a synthetic success so non-OAuth static MCP configs can still be saved. That fallback is not sufficient for OAuth MCP installs: the OAuth flow never runs, server.oauth_credentials is never returned, and the settings object is saved without the credentials needed for future conversations.

Desired behavior

Cloud MCP install/edit flows should have a backend endpoint that can:

1. Accept a candidate MCP server spec from the browser.
2. Run the MCP connection/OAuth probe in the cloud-side environment where conversations will run.
3. Return the complete MCP server object, including encrypted oauth_credentials, for settings persistence.
4. Preserve the existing settings DataModel contract: all necessary MCP runtime state must live under the persisted MCP server object in settings so it works for both local and cloud storage.

Notes

This is the cloud counterpart to the local agent-server MCP OAuth install flow in:

• OpenHands/software-agent-sdk#3964
• OpenHands/agent-canvas#1583
• OpenHands/extensions#387

Until this exists, agent-canvas should avoid treating the synthetic cloud MCP test success as proof that OAuth MCP credentials have been captured.

Start by reviewing the local agent-server /api/mcp/test OAuth flow and the persisted MCP server object in the settings DataModel, then trace the cloud MCP install/edit path. Compare the related work in OpenHands/software-agent-sdk#3964, OpenHands/agent-canvas#1583, and OpenHands/extensions#387. Done means the cloud flow probes OAuth and returns encrypted oauth_credentials within the persisted server object.