[Fix] Linear session resumes with the wrong authorized account

[roomote-roomote]

Opened on behalf of Matt Rubens. Follow up by mentioning @roomote-roomote, in the web UI, or in Slack.

What changed

Linear OAuth replays now require the authorized viewer's user ID and organization ID to match the identity saved with the original session. Successful authorization stores identity metadata and OAuth tokens together in one connection update.

Replay setup no longer clears an existing Linear connection, and a mismatch leaves its metadata, tokens, enabled state, and authentication status unchanged while keeping the replay unconsumed.

Focused coverage verifies both user and organization mismatches, as well as callback token-storage ordering.

Why this change was made

The replay flow previously accepted any Linear viewer and organization, which could link a different Linear account and start the original session under an identity that had not initiated it. This addresses the identity-binding issue reported in PR #887.

Impact

Users must authorize the same Linear account and organization that initiated a replayed session. Incorrect account selection now fails safely without replacing or disconnecting an existing Linear link, while successful authorization cannot leave mixed token and identity state.

[roomote-roomote]

No new code issues found. See task

• apps/web/src/app/api/mcp-oauth/callback/route.ts:320-331 Store token and identity metadata atomically or validate the identity before either write. Resolved: Linear identity metadata and OAuth tokens now persist in one connection update.
• apps/web/src/lib/server/mcp-linear.ts:197-210 Preserve an existing Linear link when rejecting a replay identity mismatch. Resolved: replay setup no longer resets an existing connection, and this mismatch no longer marks it errored.

_{Reviewed 0296736}

[roomote-roomote]

Fixed both review findings in 02967366: Linear identity metadata and OAuth tokens now persist in one connection update, and replay mismatches preserve any existing Linear link while leaving the replay unconsumed. See task.