🤖 CoderMCPServer: check that inactive credentials are cleared on every apply #314

Problem

#307 checks the answer of the apply PATCH: when the PATCH changes the auth type, Coder must report the other types' credentials as cleared (has_api_key, has_custom_headers, has_oauth2_secret). The check runs only when the GET before the PATCH shows a different auth type (mcpServerUpdateMismatch in internal/controller/codermcpserver_apply.go).

If Coder changes the auth type but keeps the old credential, the first reconcile stalls with CoderAnswerMismatch. A later retry sees the new auth type in the GET, so the check is skipped, and the generation can become Ready while Coder still stores the old credential.

The kind is not registered, so no install is affected today.

Expected

Check every inactive has_* flag on every full-spec apply, not only on the transition, plus one test for the retry case. About 5 lines. A dashboard edit that stores another type's credential then also shows as CoderAnswerMismatch, which the M6 drift path then sets back.

Belongs to M6 (the update path, which owns auth type changes). Found by the Codex review of #307 (thread 4266502725).

Refs #155

Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: high • Cost: $94.89