MCP OAuth discovery state no longer wiped during a concurrent re-save

Invalidating stored OAuth discovery data now bails out instead of clearing it when the stored entry has no authorization server metadata, which is the signature of another save writing just the URL at the same time. This prevents a race that could throw away working discovery state.