[Fix] Verify Linear workspaces with Linear OAuth tokens

[daniel-lxs]

Summary

• send Linear workspace connections through Linear's standard OAuth endpoints
• store and refresh the resulting provider token through the shared MCP OAuth path
• use that token to verify and save Linear workspace metadata
• report missing self-hosted OAuth configuration before starting the flow
• document the required self-hosted environment variables

Why

The previous flow obtained a token for the Linear MCP resource, then passed that token to the Linear API. The token was valid for MCP calls but not for Linear API calls, so authorization appeared to succeed while workspace verification failed.

Testing

• completed the full OAuth flow against a local Roomote instance and a test Linear OAuth app
• confirmed the browser returned to Roomote with Linear enabled
• confirmed the authenticated connection, scopes, encrypted tokens, and workspace metadata were persisted
• web OAuth tests: 15 passed
• SDK OAuth tests: 16 passed
• full pre-push validation passed

[roomote-roomote]

1 issue outstanding. See task

• apps/web/src/app/api/mcp-oauth/initiate/[connectionId]/route.ts:232 Existing Linear connections retain dynamically registered MCP client credentials, so the new direct Linear flow reuses an invalid client instead of replacing it with the configured Linear OAuth client. Their next refresh also sends the existing MCP refresh token/client to Linear's API token endpoint and fails. Reset or migrate legacy Linear OAuth state before using the override.

_{Reviewed 82347f5}