fix: guard findToken with deleteTokens check in blocking OAuth path

Match the returnOnOAuth path's defense-in-depth: only enable client
registration reuse when deleteTokens is also available, ensuring
cleanup is possible if the reused client turns out to be stale.

packages/api/src/mcp/MCPConnectionFactory.ts

@@ -664,7 +664,7 @@ export class MCPConnectionFactory {
         this.serverConfig.oauth_headers ?? {},
         this.serverConfig.oauth,
         this.allowedDomains,
-        this.tokenMethods?.findToken,
+        this.tokenMethods?.deleteTokens ? this.tokenMethods.findToken : undefined,
       );
 
       reusedStoredClient = flowMetadata.reusedStoredClient === true;