v0.3.6 — DATEV sandbox connector & OAuth refresh hardening

Features

• DATEV Online APIs (Sandbox) connector (#436): a dedicated, pre-configured marketplace adapter for DATEV's sandbox environment (openidsandbox authorize, sandbox-api token, platform-sandbox/v2 API paths, client_secret_basic). Every DATEV app must run in the sandbox until DATEV grants production approval — this removes the error-prone manual URL/path editing the single production adapter required. Generated from the production adapter so the tool definitions never drift.

Fixes

• REST OAuth connectors: tools now work immediately after authorization (#436): the freshly-issued access token is loaded into the in-memory MCP registry right after it is stored. Previously the reload lived inside the MCP tool-discovery block, which throws for non-MCP (REST/GraphQL) servers, so a just-authorized REST connector kept serving with a stale, token-less snapshot and returned 401s.
• Token refresh hardened for rolling refresh tokens (#436): the refresh flow re-reads the freshest refresh token from the DB instead of a stale registry snapshot (providers like DATEV rotate the refresh token on every use), and the OAuth callback merges issued tokens into the existing authConfig instead of replacing it (preserving authorizationUrl/scopes for re-authorization).

Verification: backend typecheck + lint clean; src/connectors + src/auth 389 tests pass (new regression tests for the reload and rolling-refresh paths); DATEV sandbox endpoints + client_secret_basic verified read-only against DATEV.