refactor(mcp): replace as unknown as globalThis casts with declare global

Use proper TypeScript `declare global` + `??` assignment pattern to
initialize HMR-safe singletons without double casts or non-null
assertions. Also removes dead eslint-disable comments (oxlint is used).

apps/nextjs/src/app/api/mcp/oauth/_store.ts

@@ -34,18 +34,16 @@ interface OAuthStore {
   cleanupTimer: ReturnType<typeof setInterval> | null;
 }
 
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-const globalStore = globalThis as unknown as { mcpOAuthStore?: OAuthStore };
-if (!globalStore.mcpOAuthStore) {
-  globalStore.mcpOAuthStore = {
-    clients: new Map(),
-    authCodes: new Map(),
-    pendingAuths: new Map(),
-    cleanupTimer: null,
-  };
+declare global {
+  var mcpOAuthStore: OAuthStore | undefined;
 }
 
-const store = globalStore.mcpOAuthStore;
+const store = globalThis.mcpOAuthStore ?? (globalThis.mcpOAuthStore = {
+  clients: new Map(),
+  authCodes: new Map(),
+  pendingAuths: new Map(),
+  cleanupTimer: null,
+});
 const clients = store.clients;
 const authCodes = store.authCodes;
 const pendingAuths = store.pendingAuths;

apps/nextjs/src/app/api/mcp/oauth/register/route.ts

@@ -8,12 +8,14 @@ interface RateLimitStore {
 const REGISTER_RATE_WINDOW_MS = 60_000;
 const REGISTER_MAX_ATTEMPTS = 5;
 
-const globalStore = globalThis as unknown as { mcpRegisterRateLimit?: RateLimitStore };
-if (!globalStore.mcpRegisterRateLimit) {
-  globalStore.mcpRegisterRateLimit = { attempts: new Map(), timer: null };
+declare global {
+  var mcpRegisterRateLimit: RateLimitStore | undefined;
 }
-// eslint-disable-next-line @typescript-eslint/no-non-null-assertion
-const store = globalStore.mcpRegisterRateLimit!;
+
+const store = globalThis.mcpRegisterRateLimit ?? (globalThis.mcpRegisterRateLimit = {
+  attempts: new Map(),
+  timer: null,
+});
 const registerAttempts = store.attempts;
 
 if (!store.timer) {

apps/nextjs/src/app/api/mcp/oauth/token/route.ts

@@ -18,12 +18,14 @@ interface RateLimitStore {
 const TOKEN_RATE_WINDOW_MS = 60_000;
 const TOKEN_MAX_FAILURES = 10;
 
-const globalStore = globalThis as unknown as { mcpTokenRateLimit?: RateLimitStore };
-if (!globalStore.mcpTokenRateLimit) {
-  globalStore.mcpTokenRateLimit = { failures: new Map(), timer: null };
+declare global {
+  var mcpTokenRateLimit: RateLimitStore | undefined;
 }
-// eslint-disable-next-line @typescript-eslint/no-non-null-assertion
-const store = globalStore.mcpTokenRateLimit!;
+
+const store = globalThis.mcpTokenRateLimit ?? (globalThis.mcpTokenRateLimit = {
+  failures: new Map(),
+  timer: null,
+});
 const tokenFailures = store.failures;
 
 if (!store.timer) {