fix(web): notify parent on MCP OAuth callback when opener is missing

[Souravrajvi0]

Important

1. Make sure you have read our contribution guidelines
2. Ensure there is an associated issue and you have been assigned to it
3. Use the correct syntax to link this PR: Fixes #<issue number>.

Summary

Fixes #39752

After MCP OAuth authorization completes, the backend redirects to /oauth-callback. The callback page previously rendered an empty <div /> and only notified the parent console window when window.opener was available. After cross-origin OAuth redirects (e.g. Notion MCP), browsers can drop the opener reference, leaving users on a blank page and preventing the console from refreshing authorization state.

This change:

• Adds a BroadcastChannel fallback so the parent window still receives the OAuth completion event when window.opener is missing
• Deduplicates popup callbacks when both postMessage and BroadcastChannel fire
• Shows success/error feedback on the callback page instead of a blank screen
• Adds unit tests covering param parsing, notification paths, and popup callback delivery

Root cause

useOAuthCallback gated all parent notification and window closing behind if (window.opener). When the opener reference is lost during the OAuth redirect chain, the hook did nothing and the page rendered an empty container.

Impact

• MCP OAuth authorization (and other flows using openOAuthPopup / /oauth-callback) now reliably notify the console even when window.opener is unavailable
• Users see authorization success/failure feedback if the popup cannot auto-close
• No backend or API contract changes

Screenshots

Before	After
Blank page after OAuth callback	Success/error message with auto-close attempt

N/A for automated VM validation — requires live OAuth provider redirect.

Checklist

• This change requires a documentation update, included: Dify Document
• I understand that this PR may be closed in case there was no previous discussion or issues. (This doesn't apply to typos!)
• I've added a test for each change that was introduced, and I tried as much as possible to make a single atomic change.
• I've updated the documentation accordingly.
• I ran make lint && make type-check (backend) and cd web && pnpm exec vp staged (frontend) to appease the lint gods

Validation

cd web && pnpm exec vp test run hooks/use-oauth.spec.ts
# 16 passed

cd web && pnpm exec vp test run app/components/tools/mcp/detail/__tests__/content.spec.tsx
# 44 passed (existing MCP auth tests still pass)