Slack MCP: a rejected token refresh shows as InvalidOAuthResponse instead of needs_auth

What happens

After the Slack login stops refreshing, every Slack call fails and fx mcp list --connect shows:

slack source=profile scope=profile policy=optional transport=http state=failed auth=authenticated status=failed

With FX_TRACE=1 FX_TRACE_SCOPES=mcp FX_TRACE_STDERR=1, the only trace line is:

[mcp] connection failed for server slack: InvalidOAuthResponse

fx doesn't mark the server needs_auth, so it never asks me to sign in again. Each time, I run fx mcp auth slack and then /mcp reload in every open session. This has happened on three days in a row with the Slack preset (fx mcp add slack).

Cause

Slack's token endpoint (https://slack.com/api/oauth.v2.user.access) reports errors with HTTP 200 and "ok": false, not with an RFC 6749 400 response:

$ curl -sS -D - -X POST https://slack.com/api/oauth.v2.user.access \
    -d 'grant_type=refresh_token&refresh_token=xoxe-1-bogus&client_id=12364000946.12017137861236'
HTTP/2 200
content-type: application/json; charset=utf-8

{"ok":false,"error":"invalid_refresh_token"}

refreshCredentialsCore looks for invalid_grant only when the status is 400 (mcp_auth.zig#L942-L948). A 200 goes straight to dupeRequiredSecret(alloc, object, "access_token"), which returns error.InvalidOAuthResponse because the body has no access_token (L956).

The rejection never becomes McpRefreshRejected. The Refused path that tests/tla/mcp_host/SharedLogins.tla models (drop the tokens, need a login, pick up a newer saved login) doesn't run.

Suggested fix

When the token endpoint returns 200 with "ok": false, map "error": "invalid_refresh_token" to McpRefreshRejected and other errors to McpRefreshUnavailable. The same check probably belongs in the authorization-code exchange.

Open question

I don't know why the refresh token goes bad each day. I usually have several fx sessions open with Slack connected. If two processes refresh with the same rotating refresh token, Slack would reject the second one. I haven't confirmed this.

fx 0.0.13 on macOS with the Keychain store. Code links are at 5a3a5f39bf53.