Allow OAuth U2M logins to send RFC 8707 resource indicators - #6621

Give every coding agent a working login flow for connection-backed AI Gateway
mcp-services endpoints, done in the stdio proxy every agent already spawns — no
new library (cf. mcp-remote) and no per-agent OAuth app.

When AI Gateway has no per-user connection credential it answers with HTTP 401
(RFC 9728). The proxy's httpx auth hook already sees every response, so on a 401
for a connection-backed URL it runs the Databricks CLI U2M login with an RFC 8707
resource indicator (`databricks auth login --resource <mcp-url>`, using the CLI's
own registered redirect — no --client-id), then retries with a fresh token. A
resource-aware /oidc drives the connection's SaaS login before minting the token,
so the retry succeeds — transparently to the agent, which just sees the request
authenticate rather than a failed tools/list. A later credential revoke re-triggers
the login on the next 401.

New module mcp_connection_login holds connection_from_url + run_connection_login;
mcp_proxy._build_token_auth gains the login-on-401 retry. Unit-tested. Depends on
the CLI --resource flag (databricks/cli#6621) and /oidc resource handling (login).

Co-authored-by: Isaac <no-reply@databricks.com>

Give every coding agent a working login flow for connection-backed AI Gateway
mcp-services endpoints, done in the stdio proxy every agent already spawns — no
new library (cf. mcp-remote) and no per-agent OAuth app.

When AI Gateway has no per-user connection credential it answers with HTTP 401
(RFC 9728). The proxy's httpx auth hook already sees every response, so on a 401
for a connection-backed URL it runs the Databricks CLI U2M login with an RFC 8707
resource indicator (`databricks auth login --resource <mcp-url>`, using the CLI's
own registered redirect — no --client-id), then retries with a fresh token. A
resource-aware /oidc drives the connection's SaaS login before minting the token,
so the retry succeeds — transparently to the agent, which just sees the request
authenticate rather than a failed tools/list. A later credential revoke re-triggers
the login on the next 401.

New module mcp_connection_login holds connection_from_url + run_connection_login;
mcp_proxy._build_token_auth gains the login-on-401 retry. Unit-tested. Depends on
the CLI --resource flag (databricks/cli#6621) and /oidc resource handling (login).

Co-authored-by: Isaac <no-reply@databricks.com>

The connect-time connection login runs `databricks auth login --resource`; an
older CLI without databricks/cli#6621 rejects the flag and the login exits with
a cryptic parse error (seen as a bare "connection closed" in the agent). Add a
one-time `auth login --help` pre-check and, when `--resource` is absent, return a
clear "upgrade your Databricks CLI" message instead of attempting the doomed
login. Fail-open if --help can't run.

Co-authored-by: Isaac <no-reply@databricks.com>

…ices

Adds `ug mcp login`, a /mcp-style command that shows which connection-backed
AI Gateway MCP services the coding agents are configured to use are already
signed in vs. need a per-user connection sign-in, and runs the sign-in for the
ones you pick.

- Status via the EXISTING Unity Catalog REST APIs (the same ones the
  /mcp-service-login page uses), so no dependency on unshipped endpoints:
  GET /mcp-services/<full-name> -> id + source_connection (name, securable_kind);
  GET /connections/<conn>/user-credentials/<user>?dependent.mcp_service.id=<id>
  -> provisioning_info.state (ACTIVE = signed in; HTTP 404 = needs login).
  Works for ANY connection-backed MCP service, not just system.ai.* (the source
  connection is resolved from the service's own config).
- Scoped to the agents' configured MCP services (ucode state), like /mcp — not
  a workspace-wide connection scan.
- `--services` targets specific services non-interactively (full `system.ai.github`
  or short `github`), `--agents` scopes to agents — symmetric with `ug mcp add`;
  bare shows the picker.
- Sign-in is `databricks auth login --resource <mcp-url>` (RFC 8707,
  databricks/cli#6621); an older CLI without --resource is reported as a clear
  'upgrade your CLI' error rather than a cryptic failure.

Co-authored-by: Isaac <no-reply@databricks.com>

`ug mcp login` shows which of the connection-backed AI Gateway MCP services the
coding agents are configured to use are already signed in vs. still need a
per-user connection sign-in, and runs the sign-in for the ones you pick
(interactive picker) or name with `--services` / scope with `--agents`.

Reuses databricks#679's building blocks: the developer + workspace-managed server
enumeration is extracted from `list_mcp_command` into a shared
`configured_mcp_servers_by_name` (behavior-preserving) that both `ug mcp list`
and `ug mcp login` call, and the status is rendered with the same rich Table +
`status_badge` styling from `ucode.ui`.

Per-service status comes from the existing Unity Catalog REST APIs (the ones the
`/mcp-service-login` page uses); sign-in is `databricks auth login --resource`
(RFC 8707, databricks/cli#6621), so it works for any connection-backed MCP
service, not just `system.ai.*`. The credential is per-user and shared across
agents, so signing in once unblocks the service for every agent.

Co-authored-by: Isaac <no-reply@databricks.com>