MCP re-auth fails with InvalidOAuthScope when the saved scope is comma-separated (Slack)

What happens

When a Slack entry uses its own Slack app (oauth.client_id set to an app other than fx's), signing in again while a saved login exists fails before the browser opens:

fx mcp auth failed: InvalidOAuthScope.

Running fx mcp logout slack before fx mcp auth slack works, because no saved scope is left. Reproduced on fx 0.0.13 with a saved Slack login.

Cause

Slack's oauth.v2.user.access returns scope as a comma-separated list, for example "scope": "channels:history,chat:write,im:history". fx saves it as is.

On the next sign-in, requestedScope always merges the saved scope first (mcp_auth.zig#L692). appendScopeTokens splits only on whitespace (L2515), so the whole list becomes one token. With a long scope list, that token is over max_scope_token_bytes (256), and appendUnique returns error.InvalidOAuthScope (L2525). With a short list, fx would send Slack a scope like a,b that Slack doesn't recognize.

The Slack preset doesn't hit this because the fx.sh bridge sends a fixed scope.

Suggested fix

Split saved scopes on commas as well as whitespace, or convert the token response's scope to space-separated before saving it.