fix(mcp): reject delegated redirects using supported Worker mode

[mrgoonie]

OAuth-authenticated API calls fail on Cloudflare Workers because that runtime rejects fetch requests configured with redirect: error. Use its supported manual mode and explicitly reject every 3xx response before any second request, retaining the existing credential isolation contract.

The regression test passes through to the real local HTTP server, verifies manual mode, and confirms no redirect target is contacted.

Validation:

• Nine OAuth tests pass on Node 18.20.8 and Node 24.
• All 22 OAuth/Worker tests and typecheck pass.
• The fix was deployed during live staging and production rollout after the runtime failure was observed.
• The existing nine-job repository compatibility matrix must pass before merge.