fix: inject stored OAuth token for authorization_code gateway manual refresh

[ecthelion77]

Summary

Fixes #4193

The POST /gateways/{id}/tools/refresh endpoint silently returns 0 tools for OAuth gateways using the authorization_code grant type, because refresh_gateway_manually() never retrieves the stored OAuth token from TokenStorageService.

Root Cause

_initialize_gateway() has an early-return at L4065-4074 for authorization_code gateways when oauth_auto_fetch_tool_flag=False (the default). Since refresh_gateway_manually() only passes HTTP passthrough headers (not the stored OAuth token), the function always takes the early-return path and returns {}, [], [], [].

This is inconsistent with:

• The health check path, which retrieves the stored user token before connecting
• fetch_tools_after_oauth(), which retrieves the stored token and constructs Authorization: Bearer {token}

Fix

In refresh_gateway_manually(), when the gateway uses authorization_code OAuth and the caller has a user_email:

1. Retrieve the stored access token from TokenStorageService.get_user_token()
2. Inject it into pre_auth_headers["Authorization"]

This causes _initialize_gateway() to use pre_auth_headers (L4058-4059), bypassing the authorization_code early-return.

Changes

• mcpgateway/services/gateway_service.py: Added OAuth token retrieval in refresh_gateway_manually() (26 lines)

Testing

Tested against a live Azure AD Authorization Code OAuth gateway:

• Before: POST /gateways/{id}/tools/refresh → 0 tools in 5ms
• After: POST /gateways/{id}/tools/refresh → 4 tools imported correctly