fix: bind OAuth callback listener before browser auth

[todor-roi]

Summary

Bind the OAuth callback listener before any transport start/connect attempt can enter SDK OAuth and call redirectToAuthorization().

In mcp-remote@0.1.38, StreamableHTTPClientTransport.start() / Client.connect() can trigger OAuth and open the browser before connectToRemoteServer() catches UnauthorizedError and calls authInitializer(). If the user completes consent quickly, the provider redirects to loopback before the callback server is listening, causing ERR_CONNECTION_REFUSED.

This calls the existing authInitializer() first. That path already starts the callback server and waits for the listening event. The Unauthorized path then reuses that pre-bound auth state.

Verification

• Not run locally: this machine does not have pnpm installed.