fix MCP auth token refresh and disable legacy SSE

mcp-server/auth/credentials.js

@@ -56,7 +56,7 @@ const cleanupExpiredMcpSessions = () => {
 };
 
 // Run cleanup every 5 minutes
-setInterval(cleanupExpiredMcpSessions, 5 * 60 * 1000);
+setInterval(cleanupExpiredMcpSessions, 5 * 60 * 1000).unref();
 
 const buildApiUrlFromPublicUrl = (webUrl, explicitForgeHost = "") => {
     if (!webUrl) return null;
@@ -174,8 +174,11 @@ export const getMcpSessionCredentials = (mcpSessionId) => {
  * Set credentials by MCP-Session-Id
  */
 export const setMcpSessionCredentials = (mcpSessionId, credentials) => {
+    // The plaintext MCP PAT is only needed by the active transport. Do not keep
+    // it in the longer-lived reconnection cache.
+    const { mcp_secret: _mcpSecret, ...persistableCredentials } = credentials;
     mcpSessionCredentials.set(mcpSessionId, {
-        credentials,
+        credentials: persistableCredentials,
         lastAccess: Date.now()
     });
     console.error(`[Credentials] setMcpSessionCredentials(${mcpSessionId.substring(0, 8)}...) - website=${credentials.website} (total: ${mcpSessionCredentials.size})`);