[Bug]: OAuth callback server (port 19876) not stopped after authentication, causing cross-instance CSRF failures

[hchangjae]

Description

The OAuth callback server on port 19876 remains running after authenticate() completes. When multiple TUI instances are running, this causes CSRF state validation failures:

1. Instance A authenticates → callback server starts on port 19876 → auth succeeds → server stays running
2. Instance B starts, triggers OAuth → ensureRunning() detects port in use, skips server start
3. Instance B registers state in its own process-local pendingAuths Map
4. Browser callback arrives at Instance A's server → pendingStates=[] → CSRF error

Steps to reproduce

1. Start opencode TUI (Instance A) with a remote OAuth MCP server
2. Complete OAuth authentication
3. Start another opencode TUI (Instance B)
4. Instance B attempts OAuth → browser opens → callback fails with "Invalid or expired state parameter"

Expected behavior

Callback server should stop after authentication completes (when no other flows are pending), releasing port 19876.

Root cause

McpOAuthCallback.stop() is never called after authenticate(). The only callers are internal reconfiguration in ensureRunning() and test cleanup.

OpenCode version

1.14.19

Operating System

macOS