fix(mcp): strip oauthClientSecret from optimistic cache update

The useUpdateMcpServer optimistic update was spreading the raw updates object
into the TanStack Query cache, which briefly placed the plaintext
oauthClientSecret in client-side cache. Strip it from the optimistic spread —
the cache holds the server-sanitized record after onSettled invalidation.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: waleedlatif1

apps/sim/hooks/queries/mcp.ts

@@ -269,11 +269,12 @@ export function useUpdateMcpServer() {
       )
 
       if (previousServers) {
+        const { oauthClientSecret: _omitSecret, ...safeUpdates } = updates
         queryClient.setQueryData<McpServer[]>(
           mcpKeys.serversList(workspaceId),
           previousServers.map((server) =>
             server.id === serverId
-              ? { ...server, ...updates, updatedAt: new Date().toISOString() }
+              ? { ...server, ...safeUpdates, updatedAt: new Date().toISOString() }
               : server
           )
         )