fix(oauth): update DCR integration test for skip-invalid behavior

Commit b8b4acd changed validate_redirect_uris to skip invalid redirect URIs (only failing when zero valid URIs remain) and updated the inline unit tests in crates/mcpmux-gateway/src/oauth/dcr.rs, but missed the duplicate test in the integration crate. The stale test_mixed_valid_invalid_rejected asserted the old reject-the-whole-batch behavior and failed on all three rust-test platforms.

Replace it with test_mixed_valid_invalid_passes (mix now succeeds) and add test_all_invalid_rejected (zero valid URIs still fails), matching the new semantics and the inline tests.

Signed-off-by: Mohammod Al Amin Ashik <maa.ashik00@gmail.com>

Author: its-mash

tests/rust/tests/oauth/dcr.rs

@@ -71,11 +71,23 @@ fn test_external_https_rejected() {
 }
 
 #[test]
-fn test_mixed_valid_invalid_rejected() {
-    // One invalid URI should fail the whole validation
+fn test_mixed_valid_invalid_passes() {
+    // Invalid URIs are skipped rather than failing the whole registration, as long as
+    // at least one valid URI remains. Clients like Cursor send a mix of valid (custom
+    // scheme + loopback) and invalid (non-loopback https) URIs in a single DCR request.
     let uris = vec![
         "http://127.0.0.1:8080/callback".to_string(),
-        "https://evil.com/steal".to_string(), // invalid
+        "https://evil.com/steal".to_string(), // invalid, skipped
+    ];
+    assert!(validate_redirect_uris(&uris).is_ok());
+}
+
+#[test]
+fn test_all_invalid_rejected() {
+    // When every URI is invalid, zero valid URIs remain and registration must fail.
+    let uris = vec![
+        "https://evil.com/steal".to_string(),
+        "http://example.com/callback".to_string(),
     ];
     assert!(validate_redirect_uris(&uris).is_err());
 }