[Bug]: MCP OAuth secrets lost on CLI restart

[zeval]

What happened?

Remote OAuth MCP servers (HTTP) require a full browser login on every new Auggie CLI process.
Auth works inside one process (in-memory). After quit + start, Auggie cannot reload the stored OAuth secret and marks the MCP server as auth-required again.
This is a regression:

• ≤0.33.0: getSecret reads POST /user-secrets/get
• ≥0.34.0 (incl. 0.35.0, 0.36.0-prerelease.5): getSecret reads POST /mcp-secrets/get → 404
• setSecret still writes POST /user-secrets/upsert
  Separately, even /user-secrets/get returns "value": "" while value_size_bytes is non-zero, so older CLIs that use the correct endpoint also cannot reload secrets today.

What did you expect to happen?

After a successful MCP OAuth login, quitting and restarting Auggie should reload the stored credentials (access + refresh token) from the secrets API and reconnect without another browser login, until refresh fails or the token is revoked.
getSecret and setSecret should use the same secrets API end-to-end, and owner reads must return the actual secret value (not an empty string with only value_size_bytes set).

Steps to reproduce

1. Configure a remote OAuth MCP server in ~/.augment/settings.json, e.g.:

   "mcpServers": {
     "bowser": {
       "type": "http",
       "url": "https://example-mcp.example.com/mcp"
     }
   }

2. Start Auggie ≥0.34, complete the MCP OAuth browser flow, confirm a tool call works.
3. Quit Auggie fully (process exit).
4. Start Auggie again.
5. Observe: MCP server requires OAuth again.
   API checks after step 2 (same Augment session token from ~/.augment/session.json):

# Secret exists under user-secrets, value blanked
curl -sS -X POST "$TENANT_URL/user-secrets/list" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"include_values":true,"name_pattern":"augment-mcp"}'
# → value_size_bytes > 0, value == ""
# Path used by CLI getSecret in ≥0.34
curl -sS -X POST "$TENANT_URL/mcp-secrets/get" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name":"augment-mcp-access-token-bowser"}'
# → 404 {"error":"Not found"}

Minimal secrets round-trip (no MCP required):

NAME="auggie-secret-probe-$RANDOM"
curl -sS -X POST "$TENANT_URL/user-secrets/upsert" \
  -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
  -d "{\"name\":\"$NAME\",\"value\":\"test-value-probe-123\",\"tags\":{},\"description\":\"\",\"expected_version\":\"\"}"
# 200, value_size_bytes=20, value=""
curl -sS -X POST "$TENANT_URL/user-secrets/get" \
  -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
  -d "{\"name\":\"$NAME\"}"
# 200, value still ""

Auggie version

0.35.0 (commit 9a7f3836)

Request ID

N/A

Environment details

Environment

• OS: macOS (darwin)
• Shell: zsh
• Tool/CLI version: @augmentcode/auggie@0.35.0 (npm global via nodenv, node 24.12.0)
• Install: npm i -g @augmentcode/auggie
• API tenant: https://e5.api.augmentcode.com/
• MCP: remote HTTP + OAuth (private server, not a hosted partner MCP)
• Bisect: getSecret used user-secrets through 0.33.0; mcp-secrets from 0.34.0+
• Auto-update: currently disabled (AUGMENT_DISABLE_AUTO_UPDATE=1 / autoUpdate: false) only so local workarounds are not wiped; not required to reproduce

Anything else we need to know?

No response