[TheGreatAxios]

Summary

• The PKCE code verifier lives in provider instance memory for the browser-flow episode and never reaches the mcp-auth/*.json file; legacy verifier keys are stripped on write.
• Deleting the auth file drops the provider's in-memory tokens, and overlapping logins on different loopback ports each keep their own verifier while the shared file holds only the completed auth.
• Token refresh uses only the stored client registration and refresh token, with no verifier involved.

Verification

• bun run typecheck, bun run build, and bun run test pass
• bun run check passes: lint and typecheck clean, dead-export guard reports 0 violations, 7884 tests pass with 0 failures across 520 files
• New failing-first coverage: no verifier on disk across a full browser-flow save sequence, file delete drops memory tokens, two overlapping logins both complete

Fixes CL-9001

[linear-code]

CL-9001