List MCP sessions

Returns every per-user MCP authentication artifact visible to the caller — OAuth tokens, header credentials, and pending submission / consent flows.

Row visibility is scoped to the caller's identity (Virtual Key, signed-in user, or asserted session ID). Server-level headers / oauth clients are not surfaced here; their credentials live on the MCP client config.

When both a credential and a pending flow exist for the same (identity, mcp_client) binding, the credential is returned and the flow is suppressed to avoid duplicate entries.