Salesforce Hosted MCP Sandbox connector fails with invalid_client_id — Enhanced Domains org redirected to legacy test.salesforce.com instead of My Domain

### What happened?

No ofid_ reference ID exists for this failure — Salesforce rejects the request on its own
OAuth domain (test.salesforce.com) before any response reaches Claude's systems, so nothing
is logged on Claude's side to generate one.

Occurred: 12:14 AM EST

MCP server URL: https://api.salesforce.com/platform/mcp/v1/sandbox/platform/sobject-reads
Connecting via: Custom connector, manually entered
Where it fails: Immediately on the Salesforce OAuth authorize redirect, before any login form renders

Error:
test.salesforce.com/services/oauth2/authorize returns
error=invalid_client_id&error_description=client%20identifier%20invalid

Confirmed NOT a configuration issue — External Client App verified correct in every respect:
- Consumer Key matches exactly what's registered in the Claude connector
- Enable OAuth on; scopes: api, refresh_token/offline_access, mcp_api
- Callback URL: https://claude.ai/api/mcp/auth_callback
- Security: PKCE required, "require secret" unchecked (Web Server + Refresh Token flows),
JWT-based access tokens for named users enabled
- Permitted Users: Admin approved users are pre-authorized, correct Permission Set assigned
- App Status: Enabled

Root cause: this Sandbox has Enhanced Domains enabled
(My Domain: [company]--[sandbox].sandbox.my.salesforce.com). Salesforce's Spring '26 release
permanently ended legacy hostname (test.salesforce.com/login.salesforce.com) support for OAuth
on Enhanced Domains orgs, with no re-enable option. The OAuth redirect needs to resolve to the
org's actual My Domain URL instead — see github.com/n8n-io/n8n/issues/28990 for an unrelated
integration hitting the identical root cause on Salesforce Sandboxes.

This explains why our Production Salesforce connector (same setup pattern) still works: per
the linked n8n report, Salesforce is enforcing this sandbox-first, with production expected to
be affected on the same timeline.

### What did you expect to happen?

Expected the Connector to let me connect to our Sandbox environment.

### Steps to reproduce

1. Add https://api.salesforce.com/platform/mcp/v1/sandbox/platform/sobject-reads as a custom
connector (Organization Settings → Connectors → Add → Custom → Web), using the Client ID
from a correctly configured Salesforce External Client App in a Sandbox org with Enhanced
Domains enabled
2. Click Connect on the connector from Customize → Connectors
3. Browser hands off to test.salesforce.com/services/oauth2/authorize with the correct client_id
4. Salesforce immediately returns error=invalid_client_id, before any login form renders

### Area

MCP Connector (adding/managing servers)

### MCP Server (if applicable)

_No response_

### Error messages or logs

```shell
test.salesforce.com/services/oauth2/authorize?response_type=code&client_id=3MVG98bly0AKZIIWkqBOTEkqut...

error=invalid_client_id&error_description=client%20identifier%20invalid

No ofid_ exists for this failure — occurs on Salesforce's own OAuth domain before any response
reaches Claude's systems. Occurred 12:14 AM EST.
```

### Additional context

Confirmed NOT a configuration issue — External Client App verified correct in every respect:
- Consumer Key matches exactly what's registered in the Claude connector
- Enable OAuth on; scopes: api, refresh_token/offline_access, mcp_api
- Callback URL: https://claude.ai/api/mcp/auth_callback
- Security: PKCE required, "require secret" unchecked (Web Server + Refresh Token flows),
JWT-based access tokens for named users enabled
- Permitted Users: Admin approved users are pre-authorized, correct Permission Set assigned
- App Status: Enabled

Root cause: this Sandbox has Enhanced Domains enabled. Salesforce's Spring '26 release
permanently ended legacy hostname (test.salesforce.com/login.salesforce.com) support for OAuth
on Enhanced Domains orgs, with no re-enable option — see github.com/n8n-io/n8n/issues/28990
for an unrelated integration hitting the identical root cause.

Production connector (same pattern) still works — Salesforce is enforcing this sandbox-first.