fix(connect): resolve duplicate mcpproxy entries deterministically (#1769)

## Bug

`findEntryJSONBytes` and `findEntryTOMLBytes`
(`internal/connect/connect.go`) return the first entry in `range
serversMap` whose URL points at this instance. Go randomizes map
iteration, so when a client config holds two such entries the answer
changes from call to call.

That's a common shape: a legacy `?apikey=` entry under a custom key left
next to the current `mcpproxy` entry. `findEquivalentJSONServerName` was
already made deterministic for exactly this reason (Spec 091 FR-005).
The status lookup was not.

## Trigger

A Cursor `mcp.json` with these entries:

```json
{"mcpServers": {
  "mcpproxy":  {"url": "http://127.0.0.1:8080/mcp"},
  "old-proxy": {"url": "http://127.0.0.1:8080/mcp?apikey=OLD"}
}}
```

With this config, `GetStatus` reports `server_name` as `mcpproxy` or
`old-proxy` depending on the call. `ClientSecret`, which the credential
reconciler uses, reads the credential from whichever entry won. So it
sometimes sees `OLD` and sometimes the current key.

## Fix

Both finders now scan in a fixed order through a small `entryScanOrder`
helper: the default `mcpproxy` key first, then the remaining names
sorted. The name-only fallback and the PointsHere preference are
unchanged.

## Verification

- `go test -count=1 -run TestFindEntry_TwoEntriesPointingHere
./internal/connect/` passes. The test covers both the JSON (cursor) and
TOML (codex) paths and runs 50 lookups each.
- With `connect.go` reverted (`git stash push
internal/connect/connect.go`), the same test fails: `cursor lookup 0:
got entry "old-proxy" (pointsHere=true), want "mcpproxy"`.
- `go test -count=1 ./internal/connect/` passes.
- `go vet ./internal/connect/` is clean.
- `gofmt -l internal/connect/` is clean.

Commands were run with `GOFLAGS=-mod=readonly CGO_ENABLED=0`.

Author: rudycelekli

internal/connect/connect.go

@@ -1610,8 +1610,8 @@ func (s *Service) findEntryJSONBytes(client ClientDef, raw []byte) (loc entryLoc
 	// scan: a sibling entry that genuinely points at us wins over it.
 	var nameOnly *entryLocation
 
-	for name, v := range serversMap {
-		entry, ok := v.(map[string]interface{})
+	for _, name := range entryScanOrder(serversMap) {
+		entry, ok := serversMap[name].(map[string]interface{})
 		if !ok {
 			continue
 		}
@@ -1646,6 +1646,25 @@ func (s *Service) findEntryJSONBytes(client ClientDef, raw []byte) (loc entryLoc
 	return entryLocation{}, false, true
 }
 
+// entryScanOrder is the order the entry finders inspect serversMap in: the
+// default "mcpproxy" key first, then the rest sorted. Go randomizes map
+// iteration, and with two entries pointing here (an old ?apikey= one left
+// beside the current one) GetStatus's server name and ClientSecret's
+// credential would otherwise flip between calls.
+func entryScanOrder(serversMap map[string]interface{}) []string {
+	names := make([]string, 0, len(serversMap))
+	for name := range serversMap {
+		if name != defaultServerName {
+			names = append(names, name)
+		}
+	}
+	sort.Strings(names)
+	if _, ok := serversMap[defaultServerName]; ok {
+		names = append([]string{defaultServerName}, names...)
+	}
+	return names
+}
+
 // classifyEndpointMatch turns a matched entry into the EndpointMatch value the
 // UI renders. PointsHere is authoritative — it means the matcher recognized our
 // exact base URL. Otherwise the entry matched on its name alone: if it names an
@@ -1859,8 +1878,8 @@ func (s *Service) findEntryTOMLBytes(raw []byte) (loc entryLocation, found, pars
 
 	var nameOnly *entryLocation
 
-	for name, v := range serversMap {
-		entry, ok := v.(map[string]interface{})
+	for _, name := range entryScanOrder(serversMap) {
+		entry, ok := serversMap[name].(map[string]interface{})
 		if !ok {
 			continue
 		}

internal/connect/entry_lookup_order_test.go

@@ -0,0 +1,49 @@
+package connect
+
+import "testing"
+
+// Two entries pointing at this instance (a legacy ?apikey= one under a custom
+// key beside the current "mcpproxy" one) must resolve to the same entry on
+// every lookup, preferring the default key.
+func TestFindEntry_TwoEntriesPointingHere_Deterministic(t *testing.T) {
+	svc := NewServiceWithHome("127.0.0.1:8080", "", t.TempDir())
+
+	jsonRaw := []byte(`{"mcpServers": {
+		"mcpproxy": {"url": "http://127.0.0.1:8080/mcp"},
+		"old-proxy": {"url": "http://127.0.0.1:8080/mcp?apikey=OLD"},
+		"another": {"url": "http://127.0.0.1:8080/mcp?apikey=OTHER"}
+	}}`)
+	tomlRaw := []byte(`
+[mcp_servers.mcpproxy]
+url = "http://127.0.0.1:8080/mcp"
+
+[mcp_servers.old-proxy]
+url = "http://127.0.0.1:8080/mcp?apikey=OLD"
+
+[mcp_servers.another]
+url = "http://127.0.0.1:8080/mcp?apikey=OTHER"
+`)
+
+	cases := []struct {
+		client string
+		raw    []byte
+	}{
+		{"cursor", jsonRaw},
+		{"codex", tomlRaw},
+	}
+	for _, tc := range cases {
+		client := FindClient(tc.client)
+		if client == nil {
+			t.Fatalf("client %q not found", tc.client)
+		}
+		for i := 0; i < 50; i++ {
+			loc, found, parsedOK := svc.findEntryFromBytes(*client, tc.raw)
+			if !parsedOK || !found {
+				t.Fatalf("%s: found=%v parsedOK=%v", tc.client, found, parsedOK)
+			}
+			if loc.Name != defaultServerName || !loc.PointsHere {
+				t.Fatalf("%s lookup %d: got entry %q (pointsHere=%v), want %q", tc.client, i, loc.Name, loc.PointsHere, defaultServerName)
+			}
+		}
+	}
+}