POST /api/mcp/oauth/login returns 500 INTERNAL_ERROR for streamable-http MCP servers

## Summary

Adding a streamable-http MCP server that requires OAuth login (e.g. Higgsfield's `https://mcp.higgsfield.ai/mcp`) works — the server registers and shows a "Login" button — but clicking Login always fails with a generic 500.

## Environment

- aioncore version: v0.1.62 (reproduced; changelogs through v0.1.68 show no related fix)
- Deployment: web-only host (AIONUI_ALLOW_REMOTE=1, AIONUI_HOST=0.0.0.0)

## Steps to reproduce

1. Add an MCP server with `transport: { type: "http", url: "https://mcp.higgsfield.ai/mcp" }` via `POST /api/mcp/servers`
2. UI shows the server with a "Login" button (OAuth required)
3. Click Login → `POST /api/mcp/oauth/login` with the server id

## Actual result

```
POST /api/mcp/oauth/login -> 500
{"success":false,"error":"Internal server error.","code":"INTERNAL_ERROR"}
```

Server log for the request:
```
ERROR aionui_app::router::trace: http response request_id=31f6a7f9 method=POST path=/api/mcp/oauth/login query_keys= status=500 latency_ms=79 error_code="INTERNAL_ERROR" error_message="Internal server error."
```

No further detail is logged — just the generic HTTP-layer wrapper log line, no underlying panic/error trace, even at DEBUG level.

## Expected result

Either the OAuth authorization flow starts successfully (e.g. returns a redirect/authorization URL), or a specific, actionable error is returned and logged.

## Notes

- `POST /api/mcp/test-connection` for the same server returns `200` with `status=error, tool_count=0` (transport-level auth challenge, expected before login).
- `POST /api/mcp/oauth/check-status` for the same server returns `200` (presumably "not authenticated").
- Only `/api/mcp/oauth/login` fails, and it fails fast (79ms), suggesting an early unhandled error rather than a network timeout talking to the MCP server's OAuth endpoint.
- Malformed request bodies to this same endpoint correctly return `400 BAD_REQUEST` with `"Invalid JSON request body."`, so request validation works — the 500 happens after validation, inside the login handler itself.

Start at the POST /api/mcp/oauth/login handler and reproduce the request with the streamable-http MCP server configuration from the issue. Trace the error after request validation and compare it with /api/mcp/oauth/check-status and /api/mcp/test-connection. Done means OAuth login starts successfully or returns a specific actionable error that is also logged.

Written by the indexing model from the issue text.