The Electron listener now always emits iss (null when the server sent none) and McpOauthCallbackParams is extra="forbid", so a new Desktop against a backend without this change would fail every remote MCP OAuth login with a 4000 - including providers that never send iss. Send the key only when set. Also drop the deliver_callback_flow test the RPC test subsumes.