[andy-xu-db]

Summary

The Codex desktop app labels every stdio MCP server "Auth unsupported". ug keeps no-login AI Gateway services (system.ai.web_search, dbsql, Genie) on the stdio ug mcp-proxy, so they keep that label even after the connection-backed services switch to native OAuth.

For Codex, this PR gives every AI Gateway mcp-service the native URL + OAuth entry, so the Databricks sign-in is done by Codex itself. Claude and Cursor still skip no-login services (AIGTWY-4856, #836). Non-mcp-services URLs, PAT, and workspaces without the Codex client still use the proxy.

Stacked on #1338. Do not merge yet. It depends on:

• https://github.com/databricks-eng/universe/pull/2913655 (advertise authorization_response_iss_parameter_supported) being deployed. Without it, every Codex sign-in fails with redirect_uri '.../callback/<id>' not registered.
• A retest showing a no-login service actually completes Codex's sign-in. [AIGTWY-4856] mcp: only use native OAuth for connection-backed services (fix web_search) #836 notes a gateway-side issue where native OAuth for a no-connection service blocked. That was seen in Claude in Sep 2026 and hasn't been retested since.

Testing

• New unit test: Codex gets the native entry for a no-login mcp-service, and still gets the proxy for a non-mcp-services URL. The existing Claude no-login tests are unchanged and still pass.
• uv run pytest tests/test_mcp.py tests/test_agent_codex.py tests/test_mcp_oauth.py tests/test_databricks.py passes (895 tests), and just lint passes.
• No live sign-in yet. That's blocked on the dependencies above.

This pull request and its description were written by Isaac.