Problem

When an operator configures a static Authorization header on an HTTP MCP server via netclaw mcp add --header "Authorization: Bearer ...", the daemon blocks the connection entirely with an "Awaiting Auth" status if the server responds to the OAuth discovery probe with a 401 + WWW-Authenticate header containing resource_metadata=.

This means users who want to authenticate via a static bearer token are forced into an interactive OAuth flow that they did not request and may not be able to complete.

Root Cause

In McpClientManager.CreateClientAsync() (lines 513-528), the code only checked for cached OAuth tokens (_oauthService.GetTokenSet(name)) before running the OAuth discovery probe. It did not check whether the user had configured a static Authorization header on the server entry (entry.Headers).

If OAuth metadata was found, the daemon returned null and set status to AwaitingAuth — never reaching CreateTransport() where the configured headers would be sent.

Fix

Added a check for existing Authorization headers in entry.Headers before running the OAuth discovery probe:

var hasTokens = _oauthService.GetTokenSet(name) is not null;
var hasStaticHeaders = entry.Headers?.Any(h => 
    h.Key.Equals("Authorization", StringComparison.OrdinalIgnoreCase)) == true;

// Skip OAuth discovery if the user has already configured static auth headers.
if (!hasTokens && !hasStaticHeaders)
{
    var metadata = await _oauthService.TryDiscoverMetadataAsync(name, entry.Url, ct);
    // ... existing OAuth blocking logic
}

If static auth headers are configured, discovery is skipped and the connection proceeds normally with the configured bearer token sent through to the server.

Testing

Added McpOAuthHeaderConflictTests.cs with 3 regression tests:

1. StaticAuthHeader_WhenServerReturnsOAuthMetadata_StillConnects — the bug reproduction. Without the fix, this fails with client == null because OAuth blocking aborts the connection even though a static header is configured.
2. StaticAuthHeader_WhenServerReturnsNoOAuthMetadata_ConnectsNormally — positive control validating the test harness works.
3. CachedOAuthTokens_AreCheckedBeforeOAuthDiscovery — validates pre-existing cached tokens are still respected.

All 57 MCP tests pass with zero regressions.

Fixes #1350