[mcp] Refused OAuth callback leaves MCP connection pending until 15-minute TTL

## Observed symptom A refused OAuth callback leaves the connection pending until the flow's 15-minute TTL **Type**: bug **File**: src/api/routes/mcp-auth.ts (`readCallbackParams`, the `error` branch) **Priority**: med **Found during**: #1431 **Description**: When the authorization server redirects back with `?error=` (for example `access_denied`, or `invalid_scope` once no scope fallback is left), the callback shows "Authorization failed" but never settles the pending flow in `oauth-flow-registry`. The connection stays in `pending_auth` ("Connecting…") until the 15-minute TTL rejects it, and a personal connector answers `ConnectorBusyError` (409) to a second Connect for that whole window. ** ## Literal error text ``` Refused OAuth callback leaves MCP connection pending until 15-minute TTL ``` ## Environment GitHub issue NimbleBrainInc/nimblebrain #1433; state=OPEN ## Trigger / context **Type**: bug **File**: src/api/routes/mcp-auth.ts (`readCallbackParams`, the `error` branch) **Priority**: med **Found during**: #1431 **Description**: When the authorization server redirects back with `?error=` (for example `access_denied`, or `invalid_scope` once no scope fallback is left), the callback shows "Authorization failed" but never settles the pending flow in `oauth-flow-registry`. The connection stays in `pending_auth` ("Connecting…") until the 15-minute TTL rejects it, and a personal connector answers `ConnectorBusyError` (409) to a second Connect for that whole window. **Suggested approach**: After the state is unwrapped and the `nb_oauth_state` cookie verifies (never before, so nobody without the cookie can end a flow), call `rejectFlow(state, err)` with a typed erro ## Source evidence - https://github.com/NimbleBrainInc/nimblebrain/issues/1433 (2026-09-29T23:56:29Z) — GitHub issue #1433 (OPEN) ## Freshness - classification: FRESH_7D - retrieved_at: 2026-10-02T09:33:42Z - scout_id: Cf59a8d393a ## Scout notes This Problem was published by the KFA Fresh Friction Scout from public sources. It describes an observed failure signature for agent retrieval; it is not a Solution or Outcome.