fix(mcp-clients): strip __binding recursively from configuration state before JWT embed

[pedrofrxncx]

Source: bug found while auditing apps/api/src/mcp-clients/outbound/headers.ts (MCP outbound transport robustness focus area).

Why: stripBindingMetadata exists specifically to prevent 431 (header-too-large) errors by stripping the __binding key — which embeds full tool schemas — from configuration_state before it's put in the JWT sent to downstream MCP servers. It only checked one level deep: a top-level state key whose direct object value carried __binding. Since Studio doesn't control a downstream MCP's config schema, a binding field can legitimately live inside an array (a multi-value connection selector) or a nested/grouped object — neither shape got stripped, silently reopening the exact 431 failure the function was written to prevent.

Fix: made the strip recursive over both arrays and nested objects, instead of a single shallow pass over top-level keys. Behavior for the existing shape (top-level object value with __binding) is unchanged — this only widens coverage to shapes it previously missed.

Verify: bun test apps/api/src/mcp-clients/outbound/headers.test.ts — new pure-logic unit test covering top-level, array, and nested-object __binding stripping, plus the untouched-passthrough cases.

Checked locally: bun run fmt, cd apps/api && bunx tsc --noEmit (clean), bunx oxlint on both changed files (0 warnings/errors), and the targeted test above (5 pass). Full CI validates the rest.

---

Summary by cubic

Prevents 431 header-too-large errors by recursively stripping __binding from configuration_state before embedding it in the JWT. Previously only top-level object values had __binding removed; now arrays and nested objects are covered.

• Recurses through arrays and nested objects and removes __binding at any depth; preserves existing top-level behavior.
• Only affects the JWT metadata payload; does not mutate input or stored state.
• Broadens stripBindingMetadata to accept unknown; call site now guards null/undefined.
• Adds unit tests covering top-level, array, nested-object stripping, and passthrough cases.

^{Written for commit 94cc8b3. Summary will update on new commits.}