fix(mcp,tests): sync stubs and cold-start assertions with delegate-check

The merge of base-branch _target_servers_delegate_auth_to_upstream
into process_mcp_request inserts an additional
get_mcp_server_by_name(name) lookup ahead of the cold-start path,
which breaks two test patterns:

1. lookup_by_name(name) side-effect stubs in
   TestMCPDelegateAuthToUpstream are called positionally by the
   delegate check, then again by the cold-start path with
   client_ip=... — raising TypeError: unexpected keyword argument
   'client_ip'. Accept **_kwargs to match the real signature.

2. TestMCPPassthroughColdStartAdmission assertions count the lookup
   exactly once with client_ip=..., but the delegate check now adds
   a positional-only call ahead of it. Switch assert_called_once_with
   to assert_any_call for the cold-start invocation, and assert
   client_ip was *not* passed for the aggregate /mcp test where
   cold-start must not fire.

Both updates align with CLAUDE.md guidance to keep monkeypatch stubs in
sync with the real signature when an optional parameter is added.

Co-authored-by: Claude <claude@anthropic.com>

tests/test_litellm/proxy/_experimental/mcp_server/auth/test_user_api_key_auth_mcp.py

@@ -918,7 +918,13 @@ class TestMCPPassthroughColdStartAdmission:
                 await MCPRequestHandler.process_mcp_request(scope)
 
             assert exc_info.value.status_code == 401
-            mock_mgr.get_mcp_server_by_name.assert_not_called()
+            # Cold-start lookup (signaled by the ``client_ip`` kwarg) must not
+            # fire for the aggregate ``/mcp`` route — only path-targeted
+            # routes are eligible for OAuth discovery admission.
+            assert not any(
+                "client_ip" in c.kwargs
+                for c in mock_mgr.get_mcp_server_by_name.call_args_list
+            )
 
     async def test_cold_start_rejects_server_specific_authorization_header(self):
         from fastapi import HTTPException
@@ -1016,7 +1022,7 @@ class TestMCPPassthroughColdStartAdmission:
                 await MCPRequestHandler.process_mcp_request(scope)
 
             assert exc_info.value.status_code == 401
-            mock_mgr.get_mcp_server_by_name.assert_called_once_with(
+            mock_mgr.get_mcp_server_by_name.assert_any_call(
                 "passthrough_server", client_ip="203.0.113.10"
             )
 
@@ -1111,7 +1117,7 @@ class TestMCPPassthroughColdStartAdmission:
             (auth_result, *_rest) = await MCPRequestHandler.process_mcp_request(scope)
 
             assert isinstance(auth_result, UserAPIKeyAuth)
-            mock_mgr.get_mcp_server_by_name.assert_called_once_with(
+            mock_mgr.get_mcp_server_by_name.assert_any_call(
                 "passthrough_server", client_ip=""
             )
 
@@ -1148,7 +1154,7 @@ class TestMCPPassthroughColdStartAdmission:
             (auth_result, *_rest) = await MCPRequestHandler.process_mcp_request(scope)
 
             assert isinstance(auth_result, UserAPIKeyAuth)
-            mock_mgr.get_mcp_server_by_name.assert_called_once_with(
+            mock_mgr.get_mcp_server_by_name.assert_any_call(
                 "passthrough_server", client_ip=""
             )
 
@@ -1996,9 +2002,12 @@ class TestMCPDelegateAuthToUpstream:
             delegate_auth_to_upstream=True,
         )
 
-        def lookup_by_name(name):
+        def lookup_by_name(name, **_kwargs):
             # Only the *exact* delegated name resolves. Anything else (e.g.
             # ``delegated_server/extra``) returns None so the bypass fails.
+            # ``**_kwargs`` accepts the ``client_ip`` kwarg the cold-start
+            # admission path now forwards (real signature:
+            # ``get_mcp_server_by_name(name, client_ip=None)``).
             if name == "delegated_server":
                 return delegate_server
             return None
@@ -2059,7 +2068,10 @@ class TestMCPDelegateAuthToUpstream:
             auth_type=MCPAuth.api_key,
         )
 
-        def lookup_by_name(name):
+        def lookup_by_name(name, **_kwargs):
+            # ``**_kwargs`` accepts the ``client_ip`` kwarg the cold-start
+            # admission path now forwards (real signature:
+            # ``get_mcp_server_by_name(name, client_ip=None)``).
             return {
                 "delegated_server": delegate_server,
                 "non_delegate_server": non_delegate,