upstream: recover discovery after a restart, drop stale personal links

[selic]

Fixes #42, fixes #44 — two ways the gateway kept serving state that no longer existed.

#42 — a restarted upstream lost its tools permanently

connection.ts already had isStaleSession() and the retry-once dance, but only on callTool(). listTools() had neither, so when an upstream restarted and 404'd our forgotten session, discovery threw, doRefresh omitted that upstream, and every one of its tools left the catalog — with no self-recovery, because the local transport still looked healthy and connect() kept succeeding. Discovery now recovers exactly the way a call does.

The other half of the report was that this was invisible: connected: true / lastError: null / toolCount: 0 reads exactly like "this server has no tools". The manager now records why an upstream contributed nothing and surfaces it as lastError, clearing it when discovery works again.

#44 — rotated credentials kept being ignored

Personal per-user links are memoized per principal and were only flushed by the upstream lifecycle, so a credential saved on /me had no effect until someone bounced the upstream. The credential write and delete paths now drop that caller's own link — and only theirs — and return reconnected so the UI can say what happened.

Found while fixing it: the flush was dead code

The pool was keyed ${upstreamId} ${sessionKey} (a space) while closePersonalLinks() searched for a control-character prefix, so it had never matched anything. The existing "upstream removal closes and forgets personal links" test passed for the wrong reason: upsertUpstream rebuilds the shared link and the assertion counted factory calls.

Both sites now go through a single PERSONAL_KEY_SEP constant, and manager.ts is a text file again — the raw NUL bytes that made this impossible to see (git and grep both treated it as binary) are gone.

Tests

• connection.test.ts — discovery re-initializes exactly once against the fake upstream that expires sessions. Verified to fail without the fix.
• manager.test.ts — a discovery failure is reported as lastError and cleared on the next good refresh.
• personal-sessions.test.ts — a credential write rebuilds only the writer's link; another principal's link survives; a delete drops the link and the next call falls back to the shared credential rather than a ref that no longer exists.
• The pre-existing "no needless session churn" assertion is now relative, so cases added above it can't shift an absolute count.

npm run build clean, npm test 288 passed. Not deployed.

🤖 Generated with Claude Code