fix(storage): Phase 3 — Backfill stale approved OAuth client flags

Signed-off-by: crimsonsunset <jsangio1@gmail.com>

Author: crimsonsunset

crates/mcpmux-storage/src/database.rs

@@ -238,6 +238,11 @@ const MIGRATIONS: &[Migration] = &[
         name: "workspace_binding_prompt_dismissals",
         sql: include_str!("migrations/041_workspace_binding_prompt_dismissals.sql"),
     },
+    Migration {
+        version: 42,
+        name: "backfill_approved_clients",
+        sql: include_str!("migrations/042_backfill_approved_clients.sql"),
+    },
 ];
 
 /// SQLite database wrapper.
@@ -778,7 +783,7 @@ mod tests {
                 |row| row.get(0),
             )
             .unwrap();
-        assert_eq!(version, 41);
+        assert_eq!(version, 42);
 
         let v16_name: String = db
             .conn

crates/mcpmux-storage/src/migrations/042_backfill_approved_clients.sql

@@ -0,0 +1,10 @@
+-- Migration 042: backfill stale approved flags on OAuth clients with real traffic.
+--
+-- last_seen is only set after a successful authenticated request, which requires
+-- an already-issued token. Clients with last_seen set were already granted
+-- access; the approved flag just never caught up on legacy auto-approve paths.
+
+UPDATE inbound_clients
+SET approved = 1
+WHERE approved = 0
+  AND last_seen IS NOT NULL;