[TheGreatAxios]

Summary

• Provider setup reports auth_success with the classified first-party provider on OAuth login and validated API-key submit
• Every MCP server connection attempt reports mcp_connect with transport and settled outcome, and every browser-OAuth callback wait reports mcp_oauth
• All three events carry enum-only properties: no server names, URLs, commands, or error text leave the process

Verification

• bun run typecheck, bun run build, and bun run test pass (bun run check exit 0; 7895 pass, 0 fail)
• New leak tests in src/mcp/client-telemetry.test.ts assert identifying names and URLs appear nowhere in the serialized PostHog batch body

Fixes CL-9017

[linear-code]

CL-9017