Description

During the code review for #3579, it was noted that `connect_url_oauth` and `complete_oauth` in `crates/zeph-mcp/src/client.rs` use `map_err(|e| McpError::Connection { .. })` directly instead of the new `classify_connect_error` helper introduced in #3579.

This means HTTP 4xx authentication/authorization errors during the post-OAuth MCP handshake remain classified as `McpError::Connection` (retryable) rather than `McpError::HttpAuth` (non-retryable).

Reproduction Steps

1. Configure an MCP server with OAuth and use wrong/revoked credentials
2. Observe: `connect_url_oauth` / `complete_oauth` retries the connection on 401/403

Expected Behavior

HTTP 4xx responses (except 408/425/429) in OAuth connection paths should surface as `McpError::HttpAuth` (non-retryable), same as the primary `connect_url` path fixed in #3579.

Proposed Fix

Replace `map_err(|e| McpError::Connection { .. })` in `connect_url_oauth` and `complete_oauth` with `classify_connect_error(&server_id, e)`.

Environment

• Area: `zeph-mcp`, `crates/zeph-mcp/src/client.rs` (OAuth connection paths)
• First surfaced: code review of fix(mcp): HTTP 4xx auth errors wrapped into McpError::Connection are retried as transient #3579