MCP OAuth login drops the RFC 9207 iss callback parameter, failing servers that advertise it

Summary

codex mcp login <server> fails against any OAuth authorization server that advertises RFC 9207 support (authorization_response_iss_parameter_supported: true in its RFC 8414 metadata):

Error: failed to handle OAuth callback

Caused by:
    Authorization server response missing required issuer: expected https://<issuer>

The consent flow completes on the server (the grant is created), but the token exchange never happens — every retry leaves another orphaned grant on the server while codex mcp list stays "Not authenticated".

Root cause

The local callback server extracts only code and state from the redirect and silently drops the RFC 9207 iss parameter:

codex-rs/rmcp-client/src/perform_oauth_login.rs (v0.144.0):

match key {
    "code" => code = Some(decoded),
    "state" => state = Some(decoded),
    _ => {}
}

and later hands the result to rmcp via the two-argument wrapper:

self.oauth_state.handle_callback(&code, &csrf_state)

rmcp's plain handle_callback forwards issuer: None. Since rmcp 1.8.0, require_issuer is derived from the server's authorization_response_iss_parameter_supported metadata — when the server advertises it, a missing iss in the callback is a hard error (AuthorizationServerMissingIssuer). So a server that is more spec-conform (RFC 9207 + advertisement, as the MCP conformance guidance recommends via SEP-2468) becomes unconnectable, while servers that skip RFC 9207 entirely work fine.

Fix

Parse iss from the callback query alongside code/state and call handle_callback_with_issuer(&code, &csrf_state, iss.as_deref()) (or build an AuthorizationCallback::from_redirect_url and use handle_callback_url), so rmcp can actually perform the issuer validation it enforces.

Repro

1. Any MCP resource server whose AS metadata contains "authorization_response_iss_parameter_supported": true and whose authorize response includes iss (RFC 9207).
2. codex mcp add <name> --transport streamable-http --url https://.../mcp (or config.toml entry)
3. codex mcp login <name> → approve consent in the browser → error above.

Observed with codex-cli 0.144.0 (rmcp 1.8.0) on macOS.