[upstream #17033] 17033: MCP OAuth teardown hides provider revocation failures #369

Found while reviewing LibreChat-AI#17033 (Codex finding LibreChat-AI#17033 (comment)). cleanupMCPServerOAuth (packages/api/src/mcp/oauth/cleanup.ts) catches provider revocation failures for access and refresh tokens, logs them and clears local state, so neither the server-delete route nor account erasure learns that an external grant stayed valid. The same best-effort revocation runs on dev. Add a strict mode that clears local state and then rejects, and use it where the server record is the only retry anchor.