Handle dcode mcp login <server>.
When config_path is omitted, auto-discovered MCP configs are merged in
the same precedence order as the runtime loader, with matching trust
gating: user-level configs are always included, but project-level configs
contribute only servers with matching scoped approvals (or the process-wide
DANGEROUSLY_ENABLE_PROJECT_MCP_SERVERS allowlist) and no deny-list entry.
Untrusted project-level server entries (for example, from a .mcp.json
in a cloned repo) are skipped so attacker-controlled headers entries
cannot exfiltrate local secrets during the OAuth handshake. When
config_path is set, that file alone is loaded and treated as explicitly
trusted.
