[auth] OAuth discovery server: retry on busy port and report the bound port #117

Follow-up from the #77 investigation (#104, docs/investigations/discovery-http-server.md).

Problem. OAuthService.start_discovery_server() (nitrostack/auth/oauth.py) makes one attempt to bind HTTPServer(("localhost", port), ...) in a daemon thread. If the port is taken, the error is written to stderr and swallowed: _server stays None, no [NITROSTACK_OAUTH] marker is emitted, and the app keeps running without discovery, so a client that reads the marker never receives a port.

Reproduced on develop @ 12e65b1 with scripts/probe_discovery_port.py (macOS):

Failed to start OAuth Discovery Server on port 52642: [Errno 48] Address already in use
server object: None
bound to: None
GET failed: TimeoutError timed out

The TypeScript DiscoveryHttpServer retries port, port+1, … (autoRetry, maxRetries: 50 in OAuthModule), exposes getPort(), and rejects the start promise on failure.

Scope

• Retry on a busy port, controlled by OAUTH_DISCOVERY_AUTO_RETRY (default on) and a max-retries limit (default 50), matching TypeScript.
• Store the port actually bound on OAuthService and put it in the [NITROSTACK_OAUTH] stderr marker.
• Surface bind failures (when retry is off or exhausted) instead of swallowing them.
• Tests: busy port with retry, retries exhausted, actual port reported.

Out of scope: the extra TypeScript marker fields (type, scopesSupported, wellKnownEndpoints) until it's known whether NitroStudio reads them.

~sent from claude-code