fix(mcp): validate connection changes before publishing (v5.0 backport)
Description
Validate authentication and discover tools before saving MCP connection changes. Publish settings and tool availability together; retain saved connections when validation fails.
Manual cherry-pick of #16418 from main (1e15e42f7128cc0f9810b347bf58df0498631546). The original stack merged on main; its automatic release backport did not run. This cherry-pick applied without code changes.
Builds on https://github.com/onyx-dot-app/onyx/pull/16452. Merge this stack from bottom to top into release/v5.0.
How Has This Been Tested?
Validated the complete backport stack on release/v5.0:
- 202 frontend component tests passed across MCP configuration, authentication, setup, default Chat, and OpenAPI plugins.
- 353 backend MCP, route-contract, and OpenAPI availability tests passed.
- Changed-file pre-commit checks passed, including Python and TypeScript typing, coverage, lint, formatting, translations, and feature-map integrity.
- PostgreSQL setup and locking tests could not start: local PostgreSQL refused connections on port 5432.
- Live provider OAuth was not rerun locally. Release CI will run on this PR.
Additional Options
- [Optional] Please cherry-pick this PR to the latest release version.
Summary by cubic
Backports the MCP setup validation workflow from main (manual cherry-pick, no code changes). MCP connection changes are now validated—authentication and tool discovery—before saving, and failed attempts leave the saved URL, credentials, and tools unchanged. Adds the POST /admin/mcp/setup endpoint, publishes settings and tools atomically, rejects stale concurrent edits, and sanitizes 401 discovery errors.
Merge notes
Builds on #16452; merge this stack bottom-to-top into release/v5.0.